> For the complete documentation index, see [llms.txt](https://wiki.smhuda.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.smhuda.com/vulnerability-wiki/application-level/authentication/lack-of-rate-limiting-on-login.md).

# Lack of Rate Limiting on Login

### Severity: 

<mark style="color:green;">**Low**</mark>

### How to test:

1. Go to the login page and send the unsuccessful login attempt request to Burp Intruder
2. Change the password values for brute force to random values
3. Observe that the response to the 20 or 30th request doesn't change and the account is not locked.