GCVE-110-VULN-PYPI-2026-000644

If the skopos-fleet 0.2.1 dashboard login is reachable by people who should not operate it, any of them can keep you from signing in. Every failed login also counts against a budget shared by all addresses (auth_store.register_failed_login), and 30 failures within 15 minutes (SKOPOS_LOGIN_GLOBAL_MAX_ATTEMPTS) lock the login for every address for SKOPOS_LOGIN_LOCKOUT_SECONDS (300 by default). Sending 30 wrong passwords every five minutes keeps the login closed, including during an incident the dashboard is meant to help with. A browser that is already signed in and holds a valid session cookie is let in without the login form, so only new sign-ins are refused. The shared budget was added in 0.2.1 to bound password guessing (GCVE-110-PYPI-2026-021896). Affects 0.2.1.