Ontime CVE-2026-15586

The prerequisite is a network-reachable Ontime authentication interface whose login function lacks any lockout, rate-limiting, or throttling control after repeated failed attempts (the CWE-307 condition). No authentication, privileges, or user interaction are required to begin attacking (PR:N/UI:N). What LIMITS exploitation: the flaw only removes the barrier to repeated guessing - the attacker must still successfully guess or otherwise obtain valid credentials for the attack to yield account access, so password strength, account-naming, and any upstream controls (WAF, network ACLs restricting access to the login page) materially constrain real impact. The exact triggering endpoint and any server-side partial protections are not described in the available sources.

This is a medium-severity authentication-throttling weakness (CVSS 5.3, CWE-307) with a mixed, mostly moderate real-world risk profile. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, pre-authentication condition, which raises exposure, but the impact metrics are deliberately narrow - C:N/I:L/A:N - meaning the flaw itself only enables credential guessing rather than directly granting data access or code execution. There is no public exploit identified at time of analysis (no POC reference and no KEV listing supplied), and no EPSS score was provided, so exploitation probability cannot be quantified from the input. The vuln.today Decision label is 'this_month' - a scheduled-remediation priority, not act_now/emergency - which is consistent with a network-facing but limited-impact issue. The practical risk is bounded by two facts the signals agree on: exploitation requires an exposed authentication interface and still depends on the attacker guessing valid credentials, and the confirmed impact is only I:L. Treat this as a genuine but non-urgent exposure that is elevated where the Ontime login surface is internet-facing and backed by weak or reused passwords. Note two caveats: EPSS, KEV and SSVC automatable/technical-impact sub-fields were not supplied, so those dimensions are unassessed; and no vendor advisory or fixed version exists because the vendor did not respond to disclosure.

An attacker who can reach the Ontime authentication endpoint runs an automated credential-stuffing or password-spraying tool against a target account. Because the application does not restrict excessive authentication attempts, the attacker can submit unlimited guesses without lockout or throttling until a valid credential is found. No public exploit code is identified; the attack requires only standard brute-force tooling and network access to the login interface.