Account compromise via unlimited login attempts

Missing login rate limiting in NamelessMC Nameless before 2.0.2 allows remote attackers to compromise accounts through password guessing. The login handler accepted unlimited username or email and password attempts because the Validate class lacked a rate-limit rule. No prior account or user interaction is required; successful password guessing grants access to data available to the compromised account.