GHSA-xvc3-826v-xf47

Summary

The authentication rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending ~10 requests per minute from one IP exhausts the shared bucket and causes HTTP 429 for every user on every IP attempting to log in or complete 2FA, for as long as the attack is sustained. This is a trivially triggered, unauthenticated, panel-wide authentication denial of service.

Details

In app/Providers/RouteServiceProvider::configureRateLimiting() the limiter is defined as:

RateLimiter::for('authentication', function (Request $request) {
    if ($request->route()->named('auth.post.forgot-password')) {
        return Limit::perMinute(2)->by($request->ip());
    }

    return Limit::perMinute(10);
});

The forgot-password branch is correctly scoped with ->by($request->ip()). The fall-through return, which covers POST /auth/login and POST /auth/login/checkpoint (see routes/auth.php, the throttle:authentication group), omits ->by() entirely.

For a named limiter, Laravel 11 derives the cache key as md5($limiterName . $limit->key) (Illuminate\Routing\Middleware\ThrottleRequests::handleRequestUsingNamedLimiter). Limit::perMinute(10) is constructed with an empty key, so the resolved key is md5('authentication'), a constant identical for every incoming request. All clients therefore contend for one shared counter rather than one counter per source.

Two factors make this worse:

• throttle:authentication is registered as group middleware in routes/auth.php, so it increments before the route-level recaptcha middleware on POST /auth/login. Requests count toward the limit regardless of reCAPTCHA outcome.
• POST /auth/login/checkpoint has no reCAPTCHA at all, giving an attacker a clean, low-cost way to fill the shared bucket with malformed requests.

Once the 10/minute global limit is hit, the...