A vulnerability in FileRise allows a remote attacker to bypass per‑IP and per‑username rate limiting by rotating the username during failed login attempts. This bypass permits the attacker to launch unlimited password‑spraying campaigns from a single IP address. The weakness falls under the category of authentication circumvention, specifically failure to enforce consistent failure‑tracking across all credentials, as identified by CWE‑307. The consequence is a significant elevation of attack surface, allowing an adversary to exhaust password guess limits against multiple accounts without triggering the intended throttling.

FileRise versions prior to 3.21.0 are affected. The issue was addressed in the 3.21.0 release; earlier releases (3.20 and below) track failed logins only by source IP and username, which enables the bypass.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is not available, so the current probability of exploitation cannot be quantified, but the vulnerability is directly exploitable by any unauthenticated user with network access to the FileRise instance. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote unprivileged access to the web interface, with the attacker repeatedly sending login attempts under different usernames from the same IP to circumvent rate limits.