Is there a mechanism to prevent brute force attacks?

Yes. POLYAS prevents brute force attacks by limiting the number of accesses per unit time and IP address.