MyRezzta CVE-2026-19218

Exploitation targets MyRezzta's password-recovery (forgotten-password) feature specifically - the attacker must be able to reach the application's account-recovery endpoint over the network and abuse the weak recovery logic (CWE-640), such as a predictable/guessable reset token or weak identity verification, to take over an account. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are stated as required, so default internet-exposed MyRezzta instances in the 2.06.03-2.07.00 range are reachable targets. The main limiting factors are the product's narrow deployment footprint and that exploitation presupposes a reachable, network-exposed recovery interface; successful takeover also depends on the specific weakness in the recovery mechanism, details of which are not disclosed in the advisory.

The CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects a serious weak-password-recovery flaw (CWE-640) that a remote, unauthenticated attacker can trigger with low complexity and no user interaction, yielding high confidentiality and integrity impact (no availability impact). However, the real-world urgency is tempered by the absence of corroborating exploitation signals: no CISA KEV listing, no EPSS probability was provided in the input, and no public proof-of-concept is referenced - the only source is a single TR-CERT advisory. The signals are therefore consistent rather than conflicting (high theoretical severity, no evidence of active exploitation), but the picture is incomplete: EPSS is MISSING and cannot be used to gauge real exploitation likelihood, so prioritization should rest on the high CVSS plus the low attacker barrier rather than on confirmed in-the-wild activity. Given the product's apparently niche, region-specific footprint, this is best treated as a high-severity but likely low-to-targeted-exposure issue - patch promptly on affected MyRezzta deployments, but it is not a mass-exploitation emergency on current evidence.

A remote, unauthenticated attacker abuses MyRezzta's flawed forgotten-password flow - for example by guessing or manipulating a predictable reset token, security-question, or recovery response - to seize control of another user's account. Having hijacked the account, the attacker reads sensitive reservation/customer data (high confidentiality) and alters account or booking data (high integrity). No public exploit code is identified at time of analysis, so exploitation would require independent research of the recovery mechanism.