An improper restriction of excessive authentication attempts was found in the /login.php file of Tasin1025 SwiftBuy. Based on the description, it is inferred that the flaw allows an attacker to launch an unlimited number of login attempts from a remote source, potentially enabling credential brute‑force or denial‑of‑service attacks. Because the vulnerability is not limited by account lockout or rate limiting, repeated attempts can overwhelm the authentication process or enable account takeover if credentials are guessed.

The affected product is Tasin1025 SwiftBuy version 1.0, as indicated by the CPE entry. Any publicly reachable instance of this application is susceptible unless mitigated by external controls.

The issue carries a CVSS score of 6.3, which places it in the medium severity range. The EPSS score is reported as less than 1%, indicating a low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack is considered remote, the attack complexity is high, and exploitation is described as difficult. While the potential impact includes denial of service and possible account compromise, the likelihood of immediate exploitation remains low given the complexity and current lack of vendor response.