← Problem Library
Security L5 SECURITY-1235 · 17 min

Login throttling exists but password spray still succeeds because IPv6 address rotation defeats an IP-only rate limit key

The control appears present, yet abuse persists because the identity chosen for throttling is too easy for the attacker to rotate.

SecurityPlatform ReliabilityLevel 5Pro17 min
Scenario

An authentication surface throttles requests by source IP and still suffers sustained password spraying from clients rotating IPv6 addresses.

What to check first
  • Identify the primary failure signal in the IP-Only Throttle Weakness scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Choose a stronger throttling identity than raw source IP before just tightening thresholds.

Questions worth viewing together
What should you verify first when Login throttling exists but password spray still succeeds appears?

Community-field security problem inspired by public discussions where IPv6 address rotation bypassed IP-only authentication throttling. A rate limiter can be functioning exactly as designed and still be ineffective if it keys on the wrong identity.

What usually causes Login throttling exists but password spray still succeeds in production?

Teams often think the limiter is broken when the attacker is simply rotating around an overly narrow key.

What should you document after resolving Login throttling exists but password spray still succeeds?

Modern address rotation makes naive IP-only login throttling much weaker than it first appears.