In 0.1.1 and earlier versions of FLIP, the login page lacks mechanisms to limit the number of failed authentication attempts or to present a CAPTCHA, allowing attackers to perform automated brute‑force or credential‑stuffing attacks. The vulnerability can compromise user accounts that belong to external healthcare institutions, potentially exposing sensitive information or facilitating further malicious activity in the federated learning environment. The weakness is a classic instance of weak authentication controls (CWE‑307).

The platform affected is the Federated Learning and Interoperability Platform (FLIP) from londonaicentre, specifically releases 0.1.1 and all earlier versions.

The CVSS base score of 2.7 indicates a low severity, and the EPSS score is under 1%, suggesting that the overall likelihood of exploitation is presently low. However, the vulnerability is not listed in KEV, so no confirmed active exploits are known yet. Attackers would reach the vulnerable entry point through the public login page, attempting repeated credential submissions without any server‑side rate limiting. While successful exploitation requires valid or guessable credentials, the absence of account lock‑out or rate measurement lowers the effort required for credential‑stuffing.