AIKIDO-2026-182141

TL;DR

Sonatype Nexus Repository authentication endpoints for the UI and REST API do not restrict or throttle repeated failed login attempts. A remote unauthenticated attacker with network access to those endpoints can run unlimited credential-guessing or credential-stuffing attacks against user accounts and, on success, gain unauthorized access to artifacts, configuration, and stored credentials. The fix introduces authentication attempt rate limiting that returns HTTP 429 with a Retry-After header after consecutive failures, configurable via nexus.auth.ratelimit.* properties.