The flaw is a race condition in the login throttling mechanism of the Wazuh API, allowing concurrent requests to bypass the max_login_attempts setting. This lets an unauthenticated attacker send parallel login bursts to the authenticate and run_as endpoints, receiving multiple successful authentication attempts before failures are logged. The result is an unlimited password‑guessing ability that can lead to credential compromise. The weakness maps to improper authorization safeguards.

The vulnerability affects the Wazuh manager component and applies to all releases from version 4.0.0 up to, but not including, 4.14.8. Any environment running these versions exposes the API endpoints considered vulnerable. The flaw is tied to the Wazuh manager product only.

With a base score of 6.9 the flaw is moderate, and no EPSS score is available. The vulnerability is not listed in CISA KEV, implying no publicly known exploits so far. Attackers can exploit it remotely by contacting the exposed API endpoints and sending a burst of concurrent login requests. Because authentication is required for the run_as endpoint, the attack can only succeed if the attacker can brute‑force credentials, which without the protection could become trivial.