No rate-limiting with 2FA #3334

New Issue

GiteaMirror · 2025-11-02T05:08:58-06:00

GiteaMirror commented

2025-11-02 05:08:58 -06:00

Originally created by @EpicnessTwo on GitHub (May 14, 2019).

Gitea version (or commit ref): 1.5.0
Git version: Not Applicable
Operating system: Not Applicable
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist: Not Applicable

Description

When a user has 2FA enabled on their account, it can be easily brute forced as there's no rate-limiting on how many attempts a user can make to guess the 6 digit code.

Whilst this may seem like a slim chance of guessing the right code as there is 1 million combinations, the same issue still stands with the 2FA recovery code which may be harder to crack but they don't change every 30 seconds.

I have also reported this bug to Gogs as they also have the same issue.
...

Originally created by @EpicnessTwo on GitHub (May 14, 2019). - Gitea version (or commit ref): 1.5.0 - Git version: Not Applicable - Operating system: Not Applicable - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: Not Applicable ## Description When a user has 2FA enabled on their account, it can be easily brute forced as there's no rate-limiting on how many attempts a user can make to guess the 6 digit code. Whilst this may seem like a slim chance of guessing the right code as there is 1 million combinations, the same issue still stands with the 2FA recovery code which may be harder to crack but they don't change every 30 seconds. I have also reported this bug to [Gogs](https://github.com/gogs/gogs/issues/5700) as they also have the same issue. ...

GiteaMirror closed this issue

2025-11-02 05:08:59 -06:00

GiteaMirror commented

2025-11-02 05:09:00 -06:00

@techknowlogick commented on GitHub (May 14, 2019):

Closing this as the recommended ratelimiting is done via fail2ban, which we have documented here: https://docs.gitea.io/en-us/fail2ban-setup/

Unrelated: 1.5.0 is really out of date and has security issues with it, you may want to upgrade.

@techknowlogick commented on GitHub (May 14, 2019): Closing this as the recommended ratelimiting is done via fail2ban, which we have documented here: https://docs.gitea.io/en-us/fail2ban-setup/ Unrelated: 1.5.0 is really out of date and has [security issues](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=gitea) with it, you may want to upgrade.

GiteaMirror referenced this issue

2025-11-02 12:21:30 -06:00

[PR #3334] [MERGED] Cleanup models.User.HashPassword #16892

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#3334