This redacted-style example demonstrates how an observed issue should be documented. The organization, endpoint, evidence and scenario below are fictional and were not tested or reproduced.
Severity: Example only — severity cannot be assigned without validating the affected system, controls and business context.
Scenario: Suppose a test environment permitted repeated password attempts without delay, lockout, bot mitigation or alerting. No such behavior has been observed on a real or portfolio system.
If this condition were confirmed on a real service, automated guessing could increase the chance of account compromise, especially where users reuse weak passwords. Actual likelihood and impact would depend on authentication controls, MFA, monitoring and account sensitivity.
[No request/response, screenshot, endpoint or reproduction steps are supplied. An actual report must contain minimal sanitized evidence collected under written authorization.]