EasyAppointments 1.5.0 | Admin Login bruteforce rate limit bypass

The admin panel [/index.php/login/validate] endpoint is vulnerable to bruteforce. The application by default relies on rate limiting on server-side but this can easily be bypassed by sleeping between every 8 password attempts.

Reproduce

Please run the following code to test this:
https://gist.github.com/0xHamy/fd3e1d95e114eddcfd91961032eec7fd

At first after brute-forcing repeatedly, I got a 429 error and got rate-limited but this is easily bypass-able if you wait a few seconds after too many failed attempts. My current exploit sleeps for 10 seconds after attempting 8 passwords, within every 24 hours we can attempt 69,120 passwords.