At the federal level, the Truth in Lending Act (TILA) and the Credit Card Accountability, Responsibility, and Disclosure Act (CARD Act) require card issuers to disclose your APR clearly and follow rules about when they can change it, but neither law sets a maximum rate.
The CARD Act does restrict when banks can raise your rate. They cannot increase the APR on existing balances in the first 12 months after opening an account, and any increase on new purchases must come with 45 days' notice. But the law doesn't say what the maximum rate can be—only that it must be disclosed and can't be changed without notice.
This is different from auto loans, mortgages, and other forms of credit that are regulated more heavily. Credit cards sit in a less-regulated category, which is why rates can vary so widely. A 15% APR on one card and a 25% APR on another are both perfectly legal at the federal level.
The one federal exception is the Servicemembers Civil Relief Act (SCRA), which caps rates at 6% for active-duty military members. That's a real federal cap, but it only applies in that specific situation.