Executive brief
Delphix Continuous Data, a platform used for managing and virtualizing enterprise data, contains a flaw in its security login process. An attacker can bypass the system's account lockout protections by sending many login attempts simultaneously. This allows an unauthorized user to perform brute-force password guessing attacks without being locked out, potentially leading to unauthorized access to sensitive data environments.
Technical details
A race condition exists in the authentication component of Delphix Continuous Data (CWE-307). The vulnerability occurs because parallel login attempts are processed by the system before the failed-login counter and account lockout status are updated in the database. A remote, unauthenticated attacker can exploit this by sending a high volume of concurrent authentication requests, effectively defeating brute-force protections. This enables persistent password guessing against targeted accounts. The issue is addressed in version 2026.4.0.0.
Affected products
- Perforce Delphix Continuous Data Versions prior to 2026.4.0.0
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory