Executive brief
The AIL framework, a platform for analyzing information leaks, failed to limit the number of times a user could guess a two-factor authentication (2FA) code. This allowed an attacker who already knew a user's password to repeatedly guess the secondary security code until they gained full access to the account. A security update has been released that locks accounts after 30 failed attempts to prevent this type of automated guessing.
Technical details
AIL framework (up to version 6.8.0) contains an improper restriction of excessive authentication attempts (CWE-307) within its 2FA verification logic. While the system may have had protections for initial password entry, it lacked rate-limiting or account lockout mechanisms for the One-Time Password (OTP) stage. An attacker who has successfully completed the first stage of authentication (password) can submit an unlimited number of OTP guesses via the network. This allows for successful brute-force attacks against the 2FA requirement. The vulnerability is addressed in the AIL framework commit d3a394f, which implements a lockout of one hour after 30 failed OTP attempts.
Affected products
- AIL Project AIL framework <= 6.8.0
Timeline
- 2026-06-22: disclosed
- 2026-06-22: patched: Fix committed to AIL framework repository
- 2026-06-22: advisory