CVE-2023-24080

Critical · CVSS 9.8

Chamberlain myQ — Lack of rate limiting on password reset endpoint enabling brute-force account takeover

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-307, CWE-307

Description

A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce attack.

Search profile — drives PoC discovery

Symbols password_resetrate_limitmyQbruteforcereset_endpointaccount_takeover

Keywords CVE-2023-24080Chamberlain myQmyQ password reset bruteforcemyQ account takeovermyQ rate limiting bypassmyQ v5.222.0.32277brackish.io chamberlain myq

Versions: v5.222.0.32277 (iOS)

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

SirCryptic/resetryder needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T12:30:39.000Z