Users Can Signup With an Email That Received a Brute Force Block in Auth0
Last Updated:
Overview
A user can attempt to log in with a username/email that does not belong to any user account, and if Brute Force attack protection is enabled, an error message will be generated. However, this username/email can then go on to create a new account with that blocked username/email.
Your account has been blocked after multiple consecutive login attempts
Applies To
- Auth0
- Brute Force Protection
- Sign Up
Solution
This is the expected behavior of the Brute-Force Attack Protection feature. The feature blocks any input entered in the user identifier field on the Universal Login page after consecutive failures to log in with that identifier, up to the block limit. This is by design to ensure that any failed login attempts for users that do exist versus those that do not in the database have the same behavior, preventing user enumeration attacks. If there were a different behavior when failing to log in for an existing user versus a non-existent user, bad actors could identify which users have accounts and then perform credential-stuffing attacks on existing users in scenarios where the user's credentials appear in a data leak.
An error message will still appear on the login page indicating that the maximum amount of failed login attempts has been exceeded for a username; however, since no account exists with that username, no block is actually put in place that would prevent a new account from being created with that username.
