EUVD-2026-40325
GHSA-j2ff-7q97-h87p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated login endpoint, no complexity; C:L/I:L reflects per-account data exposure on success; A:N as the portal remains available during brute-force.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where passwords are restricted to a six‑digit numeric format, this becomes a critical issue, as such passwords can be brute‑forced in a relatively short time.
This issue was fixed in the patch published in June 2026.
AnalysisAI
Unlimited brute-force attacks against KTM System e-BOK user accounts are enabled by the complete absence of login rate limiting, account lockout, or authentication throttling on the portal's login endpoint. All versions prior to the June 2026 patch are affected, with the risk materially amplified by companion vulnerability CVE-2026-35097, which constrains passwords to a six-digit numeric format - reducing the effective keyspace to 1,000,000 combinations and making full exhaustion feasible with standard tooling in minutes to hours. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of these two flaws represents a near-trivially exploitable account takeover path against any e-BOK deployment where both vulnerabilities are present.
Technical ContextAI
KTM System e-BOK (internetowe biuro obsługi klienta) is a Polish web-based electronic customer service portal developed by KTM System, used for customer self-service interactions. The vulnerability is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts), which occurs when an application's authentication endpoint lacks any mechanism - such as CAPTCHA, progressive delays, account lockout, or request rate caps - to deter or detect credential brute-forcing. The CPE string cpe:2.3:a:ktm_system:e-bok:*:*:*:*:*:*:*:* indicates all tracked versions are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the login interface is network-accessible with no prerequisites. The interaction with CVE-2026-35097 is the critical force multiplier: a six-digit numeric password policy limits the total search space to exactly 10^6 values, which is exhaustible in a short timeframe using any HTTP-capable scripting tool or off-the-shelf credential brute-forcing utility, even at moderate request rates.
RemediationAI
Apply the patch published by KTM System in June 2026; the product page is at https://ktmsystem.pl/internetowe-biuro-obslugi-klienta/ and the CERT-PL advisory is at https://cert.pl/posts/2026/06/CVE-2026-35095/. The exact patched version number has not been independently confirmed from available data - administrators should verify the installed build against vendor release notes to confirm the fix is applied. As a compensating control prior to patching, deploy a WAF or reverse proxy rule that enforces per-IP and per-account request rate limits on the e-BOK login endpoint; note that overly aggressive thresholds may affect legitimate users on shared IP addresses such as corporate NAT. If CVE-2026-35097 (six-digit numeric password restriction) is also unpatched, independently enforcing a stronger minimum password policy - if the application allows it - would substantially reduce the practical exploitability of this brute-force path. Restricting access to the e-BOK login URL to known customer IP ranges is advisable where operationally feasible, though this may conflict with the self-service nature of the portal.
KTM System e-BOK enforces a system-wide password policy that restricts all user credentials to exactly six numeric digit
CSRF flaws in KTM System e-BOK's email-change and password-change endpoints allow any remote, unauthenticated attacker t
Session fixation in KTM System e-BOK (an online customer service portal) enables an attacker to preset a session identif
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today