Severity: MEDIUM
Location: src/Controllers/AuthController.php:808-813
Bug: Once lockout expires, counted failures also fall outside the window; exponential backoff never escalates.
Fix: Longer observation window (24h) separate from lockout duration.
Status: open. Will reply with remediation details when resolved.
Resolved.
AuthController::checkAndLockout now uses a separate, longer observation window for counting historical failures (src/Controllers/AuthController.php):
LOGIN_OBSERVE_MINUTES (default 1440 — 24h).LOGIN_LOCKOUT_MINUTES for both observation and lockout, so a user could wait out the lockout and their prior failures aged out with it — the exponential backoff never actually escalated.Now even if an attacker spaces 5 failures across a full 15-minute lockout and then waits it out, those 5 failures stay visible for 24h so the next lockout doubles in length per lockout_count.
Locking this thread.