Lab: Bypassing rate limits via race conditions
Summary: PortSwigger's lab shows a login rate limit that blocks an account after more than three failed attempts, enforced per-username rather than per-session, with the failed-attempt count stored server-side. Because a race window exists between the attempt check and the counter update, sending login requests in parallel lets more than three attempts through before the lock triggers, and a single-packet attack in Turbo Intruder then brute-forces the carlos account from a password list.
What you should know: A per-username lockout that only counts attempts after the fact is defeated by concurrency: if your login endpoint can be hit in parallel, the three-attempt ceiling is a suggestion, not a control.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026