The vulnerability resides in the dtale login endpoint (auth.py). It allows an attacker to make an arbitrary number of login attempts because the system fails to enforce rate limiting or other restrictions on authentication failures. The design flaw is difficult to exploit but has been disclosed publicly. The impact is that an adversary can eventually gain access by exhausting credentials or performing a brute‑force attack, thereby compromising confidentiality and integrity of the application data.

All versions of mangroup:dtale up to and including 3.22.0 are impacted. The issue is specifically tied to the "login" function in the Login Endpoint component of the project.

With a CVSS score of 6.3 the vulnerability is considered moderate but significant. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely leveraged in the wild. However, the attack vector is remote, making it feasible for external attackers who can reach the authentication interface. Because the flaw permits unlimited authentication attempts, a determined attacker could rotate credentials efficiently, potentially gaining unauthorized access. Users should treat the CVE as a high priority if the application is exposed to untrusted networks or users.