The flaw resides in the requestHandler function of VictoriaMetrics’ VMAuth Authentication Endpoint. An attacker can repeatedly submit authentication requests because the system does not properly restrict excessive attempts, creating a window for brute‑force or credential‑stuffing attacks. This weakness is consistent with CWE‑307, which describes the failure to limit authentication attempts, and CWE‑799, indicating reliance on untrusted input.

VictoriaMetrics VMAuth component, all releases up to and including version 1.146.0, regardless of the operating platform. The issue originates from the app/vmauth/main.go file and is resolved in v1.147.0 and later.

The CVSS score of 6.3 marks it as a medium‑severity vulnerability. Although the EPSS score is not available, the description notes that the exploit is public and considered difficult, yet possible to perform remotely against the authentication endpoint. The vulnerability is not listed in CISA’s KEV catalog, but the lack of rate limiting widens the attack surface for credential compromise and could serve as a precursor to denial‑of‑service if an adversary floods the endpoint with requests. No specific pre‑conditions beyond network access and valid credentials are required beyond the ability to guess or obtain them.