ECSoC_2026 & ELUSoC_2026 Security: Account Lockout State is Ephemeral (In-Memory)

[Sairaj2033]

Bug Description

The account lockout system for brute-force protection is currently implemented using a module-level Map in memory, completely ignoring the failedLoginAttempts and lockoutUntil fields that actually exist in the User model.

Because this state is stored in memory, it is destroyed every time the Node.js server restarts. An attacker running a brute-force script only needs to wait for a routine deployment or server reboot to completely reset their failed attempt counter.

Location & Severity

• File: controllers/Authcontroller.js (Lines 8, 24–45)
• Severity: High

[Sairaj2033]

@Sitaram8472 i would like to Fix this issue, I request You to Assign this Issue to me,
Contributor from ECSOC and ELUSOC both