{"id":"CVE-2026-22114","kind":"vulnerability","aliases":["CVE-2026-22114"],"related":[],"title":"HTTP basic auth has no retry limit, so passwords can be guessed","description":"HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.","summary":"HTTP basic authentication accepts unlimited login attempts with no backoff. Combined with a default service password, an attacker can exhaust the small password space by guessing.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-basic-auth","other"],"not_affected_if":["default-password-changed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-30T11:17:33+00:00","first_seen_at":"2026-10-30T11:29:51+00:00","triaged_at":"2026-10-30T11:31:24+00:00","updated_at":"2026-10-30T11:31:24+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-30T11:31:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HTTP basic auth has no retry limit, so passwords can be guessed","impact":"medium","summary":"HTTP basic authentication accepts unlimited login attempts with no backoff. Combined with a default service password, an attacker can exhaust the small password space by guessing.","audience":"businesses","category":"other","nicknames":[],"who_cares":["http-basic-auth"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker guesses default password and gains service access","analyst_note":"Identify the affected product and default password from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-22114; the description names no product or version.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["default-password-changed"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000581,"input_tokens":4050,"output_tokens":351,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-22114':15A,18A 'accept':26B 'attack':40B 'attempt':29B 'auth':3A,22B,51C 'authent':25B 'backoff':32B,57C 'basic':2A,21B,24B,50C 'combin':33B,58C 'cve':13A,16A 'default':36B,61C 'enforc':52C 'exhaust':42B,67C 'guess':12A,48B 'http':1A,20B,23B,49C 'http-basic-auth':19B 'keyspac':65C 'limit':7A,55C 'login':28B 'password':9A,38B,45B,63C 'retri':6A,54C 'servic':37B,62C 'small':44B 'space':46B 'unlimit':27B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T11:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"csirt@divd.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-22114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22114","severity":null,"published_at":"2026-10-30T11:17:33+00:00","modified_at":"2026-10-30T11:17:33+00:00","first_seen_at":"2026-10-30T11:29:51+00:00","fetched_at":"2026-10-30T11:29:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}