EUVD-2026-72369
GHSA-w6hf-m328-w7vc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Remote unauthenticated brute-force with no throttling is AV:N/AC:L/PR:N/UI:N; successful takeover yields C:H/I:H, but a rate-limit flaw has no genuine availability impact, so A:N.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass.
This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Account takeover in Bahçelievler Municipality's BiHayat App (versions 2.1.7 through build 07092026) is possible because the authentication flow imposes no limit on repeated login attempts, letting remote attackers brute-force credentials or bypass authentication controls entirely. TR-CERT reported the flaw and the vendor did not respond to disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the authentication or OTP-verification endpoint of the BiHayat App to be network-reachable (it is a public mobile-app backend) and depends on the absence of any rate limiting, lockout, or CAPTCHA - which is the defect itself. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, base 9.4) describes a network-reachable, unauthenticated, low-complexity flaw with high confidentiality and integrity impact - consistent with remote account takeover of a public-facing mobile backend. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - the advisory explicitly notes the vendor was contacted early but did not respond. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Assess all active BiHayat App deployments, audit recent authentication logs for suspicious login patterns, and notify security leadership of exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today