It looks like the change which merged to master last week addresses potential vulnerabilities #2 and #3 from comment #22. Is there any chance for that to be backported to supported stable branches?
As for potential vulnerability #1, I don't really see a viable way to address that, it's the intent of the feature that too many failed logins lock the account. If a deployment considers that feature problematic, they should disable it.
It looks like the change which merged to master last week addresses potential vulnerabilities #2 and #3 from comment #22. Is there any chance for that to be backported to supported stable branches?
As for potential vulnerability #1, I don't really see a viable way to address that, it's the intent of the feature that too many failed logins lock the account. If a deployment considers that feature problematic, they should disable it.