Unauthenticated lockout bypass via authentication race

Race condition in basic authentication in Siemens Mendix Runtime allows remote attackers to bypass default account lockout controls. Concurrent authentication requests are processed without sufficient synchronization, allowing lockout state updates to be bypassed; Siemens has not disclosed the affected function or state variable. Exposure requires an application to use basic authentication, and exploitation removes the default barrier against repeated password attempts without directly disclosing credentials.