Blog
Missing rate limit for old password field
Published August 25, 2026
Last changed 3 days ago

linkResolution: ✅

Added failure rate limiting

Severity reduced by:

Requires being logged in as user

Password updates are intentionally slow (~500ms/request), reducing rate at which they can be submitted


linkReport

Description:
 
A security vulnerability has been identified on the https://www.amplenote.com/account/password change website, specifically regarding the password change functionalty. The system currently lack rate limiting for the "Old Password" feld when users attempt to change their password This omission allows attackers to launch brute-force attacks against users' old passwords, potentially gaining unauthorized access to accounts...
 
Steps to reproduces:
 
Go to the Settings page. ==>>
https://www.amplenote.com/account/password
Enter the New password.
Now, enter anything in the old Password field and Turn the Intercept ON.
Capture the request send the request to Intruder and add a Payload Marker on the current password value.
Add the payload for the password field has a list of more than 100 passwords for test and start attack.
BOOM!
This should be fixed ASAP.
 
After a certain number of failed attempts within a short period, the system should rate limit or temporarily lock out further login attempts from the same IP address for security reasons.
 
The system does nt implement rate limiting or any protection against multiple failed login attempts using the Old Password" field, which makes its vulnerable to thisattacks...
 
Impact:
 
This vulnerablity poses an significant security risk as it allow malicious actors to repeatedly guess the old password without any restrictions. With enough attempts, attackers can potentially gain unauthorized access to user accounts, compromising the security and privacy of those account..
 
FIX:
 
Implement rate limiting or account lockout mechanisms for the 'Old Password field to restrict the number of failed login attempts within a specific time frame...