Vvveb 1.0.5 | User account bruteforce

The user login endpoint located at /user/login is vulnerable to bruteforce because there is no rate limiting protection.

To reproduce the issue, register an account for testing at /user/signup and then use your email and password to sign in.
Submit a correct email with an incorrect email:

POST /user/login HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------26162393051061393382488967706
Content-Length: 548
Referer: http://127.0.0.1/user/login
Origin: http://127.0.0.1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Connection: keep-alive
Cookie: _ga_90PNJH7CQ5=GS1.1.1735826854.1.1.1735826858.0.0.0; _ga=GA1.1.305814098.1735826855; PHPSESSID=EzuO8BB8K7BLfydEIx%2C1De1mJA3ONYvZBOIhjeXt-syZFn0%2C
Priority: u=0, i

-----------------------------26162393051061393382488967706
Content-Disposition: form-data; name="csrf"

9viWf6BOwWSbYYxl
-----------------------------26162393051061393382488967706
Content-Disposition: form-data; name="email"

[email protected]
-----------------------------26162393051061393382488967706
Content-Disposition: form-data; name="password"

redshark1231
-----------------------------26162393051061393382488967706
Content-Disposition: form-data; name="redirect"


-----------------------------26162393051061393382488967706--