---
id: CVE-2026-77057
title: Improper Restriction of Excessive Authentication Attempts in boneIO
summary: >-
  boneIO Black does not limit authentication attempts on its web interface (POST
  /api/login) or SSH service, and does not enforce password complexity. An
  unauthenticated remote attacker can make unlimited brute-force login attempts,
  potent…
severity: low
cvss: 2.3
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-307
vendor: boneIO
product: boneio
affected:
  - boneio >= 1.2.0 < 1.6.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T14:45:56.237Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-77057'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2026-77052'
  - url: 'https://boneio.eu/en/docs/black'
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.512Z'
---

## Overview

boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device.

This issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.

## Affected

- `boneio >= 1.2.0 < 1.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.