{"id":"CVE-2026-84473","published":"2026-11-06T19:17:57.687","lastModified":"2026-11-10T19:21:24.737","description":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-288","CWE-307"],"vendors":[],"products":[],"references":[{"url":"https://github.com/KOBUKOVUI/CVE-2026-84473","tags":[]}],"exploitRefs":[{"url":"https://github.com/KOBUKOVUI/CVE-2026-84473","tags":[]}],"hasPoc":true,"ai":{"summary":"An authentication bypass and missing brute-force protection in ownCloud server 10.16.3 allows unauthenticated attackers to repeatedly submit HTTP Basic Authentication requests to the WebDAV endpoint (remote.php/webdav/) without rate limiting, enabling unlimited online password guessing.","exploitability":"Exploitation is trivial for any remote attacker with network access to the WebDAV endpoint; no authentication or special conditions are required.","blast_radius":"Successful exploitation could lead to full account compromise of any WebDAV user, resulting in unauthorized access to sensitive files, data modification, and potential system takeover depending on user privileges.","remediation":"Upgrade to ownCloud server version 10.16.4 or later, which includes fixes for authentication rate limiting and WebDAV endpoint hardening.","detection":"Defenders should monitor HTTP access logs for repeated 401 Unauthorized responses from /remote.php/webdav/ originating from the same source IP within a short time window (e.g., >10 requests/minute), especially with identical or sequential credential attempts; elevated 401 frequency without corresponding user activity is highly suspicious.","tags":["auth-bypass","brute-force","webdav","no-privesc","remote-exploit","owasp-a7"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:49:33.342Z"}}