HTTP basic auth has no retry limit, so passwords can be guessed

HTTP basic authentication accepts unlimited login attempts with no backoff. Combined with a default service password, an attacker can exhaust the small password space by guessing.

Summary written from the sources below. Check the originals before acting.