An unauthenticated user could discover account credentials via a brute-force attack without rate limiting