Description

Nakama Console does not have any limit for the number of unsuccessful login attempts in a very short period of time.

Proof of Concept

1. Send a login request.
2. Capture the login request
3. Replay the login request with different password value.

HTTP request

POST /v2/console/authenticate HTTP/1.1
Host: localhost:7351
Content-Length: 42
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Content-Type: application/json
Origin: http://localhost:7351
Referer: http://localhost:7351/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: <some-cookies>
Connection: close

{"username":"admin","password":"admin123"}

POC:

Impact

Login Bruteforce attacks