HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
CWE-307