Summary
Login lockouts are keyed on the victim's email rather than the attacker's IP, so anyone who knows an email can repeatedly lock that user out of both password and magic-code login.
Where
internal/handler/auth.go + internal/redis/cache.go. Password sign-in tracks failures per email: 10 wrong attempts sets a 15-minute lockout keyed on the victim's email, returned before the password is even checked. Magic-code verify keeps a per-email mcvf_ fail counter with the same 10-in-15-min lockout. Neither is bound to the attacker's IP.
Additionally, MagicCodeRequest overwrites any stored code on each call, so an attacker can also repeatedly invalidate a victim's legitimately issued codes.
Impact
A clean victim-targeted availability attack: knowing someone's email lets you keep them locked out of login, and keep invalidating their real codes. The 6-digit brute force itself is correctly bounded, so this is availability, not a credential bypass.
Suggested fix
Key (or additionally key) the throttle on the request IP, use a shorter/softer lockout for the account-side counter, and consider not overwriting an unexpired code on a fresh request.
Summary
Login lockouts are keyed on the victim's email rather than the attacker's IP, so anyone who knows an email can repeatedly lock that user out of both password and magic-code login.
Where
internal/handler/auth.go+internal/redis/cache.go. Password sign-in tracks failures per email: 10 wrong attempts sets a 15-minute lockout keyed on the victim's email, returned before the password is even checked. Magic-code verify keeps a per-emailmcvf_fail counter with the same 10-in-15-min lockout. Neither is bound to the attacker's IP.Additionally,
MagicCodeRequestoverwrites any stored code on each call, so an attacker can also repeatedly invalidate a victim's legitimately issued codes.Impact
A clean victim-targeted availability attack: knowing someone's email lets you keep them locked out of login, and keep invalidating their real codes. The 6-digit brute force itself is correctly bounded, so this is availability, not a credential bypass.
Suggested fix
Key (or additionally key) the throttle on the request IP, use a shorter/softer lockout for the account-side counter, and consider not overwriting an unexpired code on a fresh request.