GHSA-r4v7-6wcg-ghj5: FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks

The /api/auth/login endpoint does not implement rate limiting, account lockout, or progressive backoff for repeated authentication failures. As a result, an attacker can perform unlimited login attempts against the endpoint. When combined with the username enumeration timing vulnerability, valid accounts can be identified and then brute-forced without restriction. The risk is further increased by a weak default password policy that only enforces a minimum length of five characters.