BiHayat App CVE-2026-6223

Exploitation requires the authentication or OTP-verification endpoint of the BiHayat App to be network-reachable (it is a public mobile-app backend) and depends on the absence of any rate limiting, lockout, or CAPTCHA - which is the defect itself. No authentication or user interaction is needed (PR:N/UI:N). Practical success is limited by the strength of the targeted secret: long, high-entropy passwords make brute-forcing infeasible, whereas short numeric PINs or OTPs make it trivial. The attacker must also know or enumerate a valid account identifier (phone number/username) to target.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, base 9.4) describes a network-reachable, unauthenticated, low-complexity flaw with high confidentiality and integrity impact - consistent with remote account takeover of a public-facing mobile backend. However, the C:H/I:H rating presumes brute-forcing reliably yields full account control; for a pure missing-rate-limit issue the realistic impact depends on password/OTP strength, so treat the high impact as plausible-but-not-guaranteed. The A:L component is weakly justified - missing rate limiting is not primarily an availability defect - and appears overstated. No EPSS score, KEV listing, or POC was provided; absence of these signals plus an unresponsive vendor suggests real but not yet demonstrated widespread exploitation. Net: credible high priority for the municipality operating the app, but the tiny, localized deployment footprint limits broad ecosystem risk.

An attacker enumerates a victim's registered phone number or username and scripts a high-speed guessing loop against the BiHayat App login or OTP-verification API, which imposes no lockout or throttling. After exhausting the limited password/OTP keyspace the attacker authenticates as the victim and accesses their municipal-service account and personal data. No public exploit code is identified, but the attack requires only a scripted HTTP client.