Account Lockout Abuse: How a Login Protection Mechanism Became a Potential DoS Vector

.اللهم انفعنا بما علَّمتنا، وعلِّمنا ما ينفعنا، وزِدنا علمًا وفقهًا وفهمًا يا رب العالمين

While testing the authentication functionality of example.com's website, I was reviewing the login flow and looking at how the application responded to repeated failed login attempts.

Account lockout mechanisms are commonly used to protect users from brute-force attacks. They are designed to stop attackers from guessing passwords by blocking accounts after multiple failed attempts.

During my testing, I noticed an interesting behavior: after several incorrect login attempts, the application locked the account.

At first, this looked like a normal security feature. However, I wanted to understand whether this protection could be abused in another way.

The question that caught my attention was:

Could an attacker intentionally trigger this mechanism against another user and prevent them from accessing their account?

This led me to investigate the account lockout behavior further.

Discovery

I started by testing the login functionality normally and observing how the application handled incorrect credentials.

After submitting an incorrect password multiple times for an existing account, I noticed that the application eventually displayed:

The lockout happened after approximately six failed login attempts.

At this point, I started analyzing the behavior from an attacker's perspective.

The important observation was:

The attacker does not need to authenticate.
The attacker only needs a valid email address.
The application applies the lockout action after repeated failed attempts.

This meant that the same mechanism designed to protect users could potentially be used to prevent users from logging in.

Impact

If abused, this issue could allow attackers to prevent legitimate users from accessing their accounts.

Potential impacts include:

Locking multiple user accounts.
Disrupting access for targeted users.
Increasing support requests due to account recovery needs.
Affecting availability of user accounts.

For businesses, account availability is an important part of user experience. A mechanism intended to protect accounts should not become an easy way for attackers to deny access to legitimate users.

Remediation

To reduce the risk of account lockout abuse, the following improvements can be considered:

Implement Rate Limiting

Apply limits based on multiple factors:

IP address
Account identifier
Device fingerprint

This helps prevent automated attempts from triggering lockouts at scale.

Add Additional Verification

After repeated failed attempts, introduce additional verification such as:

CAPTCHA
Email verification
OTP