Which versions of MicroRealEstate are affected by CVE-2026-57867?

MicroRealEstate versions through 1.0.0-alpha3 contain an authentication bypass vulnerability allowing unauthenticated attackers to brute-force unprotected OTP tokens and gain unauthorized access to…

How to fix or mitigate CVE-2026-57867?

Within 24 hours: Identify all systems running MicroRealEstate ≤1.0.0-alpha3; implement rate limiting on OTP endpoints (e.g., maximum 3 attempts per minute per IP address); enable comprehensive audit logging of all authentication attempts. Within 7 days: Review authentication logs for evidence of brute-force activity; audit user accounts for unauthorized access patterns; apply multi-factor authentication to administrative accounts. Within 30 days: Monitor vendor communications for patched version availability; evaluate upgrade path or migration to alternative property management platforms if patch timeline does not emerge.

MicroRealEstate CVE-2026-57867

Q: What is the CVSS score of CVE-2026-57867?

CVE-2026-57867 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42003 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-07 vdp@themissinglink.com.au

GHSA-j5cw-4r7c-4vw8

Authentication Bypass

8.8

CVSS 4.0 · Vendor: themissinglink

Severity by source

Vendor (themissinglink) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable, unauthenticated OTP brute-force with no state limits gives AV:N/AC:L/PR:N/UI:N; account takeover yields C:H, limited data modification I:L, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (themissinglink).

CVSS VectorVendor: themissinglink

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 06:32 vuln.today

DescriptionCVE.org

MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute-force One-Time Passwords (OTP) to log in as any user. This issue affects MicroRealEstate: through 1.0.0-alpha3.

AnalysisAI

Authentication bypass in MicroRealEstate (open-source property/real-estate management platform) through version 1.0.0-alpha3 lets remote unauthenticated attackers brute-force the One-Time Password (OTP) login flow to authenticate as any user. Because the OTP tokens are not tracked in server-side state, codes are not invalidated or rate-limited across attempts, collapsing the effective keyspace and enabling account takeover. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

MicroRealEstate is a self-hosted, containerized (Node.js microservices) application for managing rental properties, tenants, and landlords, using a passwordless/OTP factor as part of its authentication service. The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel): the OTP is treated as a valid credential but the backend performs no token state management - it does not persist, expire, single-use-consume, or throttle submitted OTP values. As a result an attacker can iterate the OTP space against a target account until a match is accepted, turning a second-factor/one-time secret into a guessable value. Exact affected packages are not enumerated via CPE in the provided data; the affected component is the MicroRealEstate authentication service in the monorepo at github.com/microrealestate/microrealestate.

RemediationAI

No vendor-released patched version is identified in the provided data (the affected range is 'through 1.0.0-alpha3' with no fix version stated), so the primary action is to consult the reporter advisory at https://www.themissinglink.com.au/security-advisories/cve-2026-57867 and the upstream project at https://github.com/microrealestate/microrealestate for a patched release or commit and upgrade to it once confirmed. As compensating controls until a fix is verified: enforce strict server-side OTP rate limiting and lockout (e.g. cap failed OTP attempts per account/IP and add exponential backoff), reduce OTP validity to a short single-use window and invalidate the code immediately after first use or expiry, and increase OTP length/entropy to enlarge the brute-force keyspace - note these require code or configuration changes to the authentication service and may add login friction. Additionally, restrict network exposure of the login/authentication endpoint (place it behind a WAF, VPN, or IP allowlist) to limit who can submit OTP guesses; the trade-off is reduced accessibility for legitimate remote/tenant users.