CVE-2026-97363

CVE-2026-97363 is a missing restriction on authentication attempts (CWE-307) in the Monta monta.app WebSocket API. A remote, unauthenticated attacker can send an unlimited number of authentication requests over the network with no user interaction. That can exhaust the service (denial of service; CVSS 4.0 availability impact rated high, 8.7) or support brute-force attempts to obtain unauthorized access, though the published CVSS vector scores confidentiality and integrity impact as none. Monta’s monta.app WebSocket API is the affected product; no version range is stated in the advisory. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Restrict the Monta WebSocket API to trusted networks and put rate limiting or lockout in front of authentication (reverse proxy, WAF, or API gateway) until the vendor ships a fix. Monitor for bursts of failed authentication on that API and rotate any credentials that may have been targeted. Apply Monta’s official patch when it is published; no fixed version is identified in the advisory data.