CodeWise Tornet Scooter Mobile App CVE-2026-7671

The vulnerability requires remote network access to the /TwoFactor endpoint and an authenticated or partially-authenticated session context (insufficient to determine exact authentication level from CVSS vector alone - PR:N indicates no privilege requirement, but whether this is unauthenticated access or access with a valid primary credential is not explicitly stated). Attack complexity is high (AC:H), implying specific technical conditions must be met: the attacker must understand the exact request format, timing, and response patterns of the /TwoFactor endpoint, and may face protocol-level obstacles such as SSL pinning, request signing, or session validation. No indication that special configuration or feature enablement is required - rate-limiting bypass appears present in default deployments of version 4.75. The mobile app's platform (iOS/Android) may impose additional constraints such as network connectivity, TLS validation, or app-specific headers that increase practical exploitation difficulty. No documentation of version-specific configurations or optional features that would limit scope.

This vulnerability presents low-to-moderate real-world risk despite public exploit availability. The CVSS score of 3.7 reflects limited impact: the attack vector is network-accessible (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), but attack complexity is high (AC:H), indicating non-trivial exploitation requirements. The confidentiality impact is low (C:L), with no integrity or availability impact. EPSS data is not provided, limiting quantitative exploitation probability assessment. The high attack complexity (AC:H) contradicts the description's claim of 'highly complex' exploitation being 'difficult' - AC:H suggests technical barriers exist, such as timing sensitivity, protocol nuances, or required knowledge of specific token formats. Exploitation status shows publicly available exploit code (E:P in CVSS vector), but no CISA KEV confirmation of active exploitation in the wild. The absence of vendor response and patch availability increases long-term risk for users unable to remediate. Without explicit configuration data, rate-limiting bypass appears possible against default deployments, but AC:H indicates this is not a trivial 'turn-key' attack. Organizations using this app should prioritize patching if available, but this is not an emergency-level threat compared to network RCE or authentication bypass in critical services.

An attacker obtains or guesses a target user's primary credentials (username/email), then uses the publicly available exploit code to send rapid, automated POST requests to the /TwoFactor endpoint with common OTP values (e.g., sequential 6-digit codes 000000-999999) or pre-computed token dictionaries. Due to absent rate-limiting, the endpoint accepts hundreds or thousands of requests per minute without throttling, account lockout, or notification. If the user's 2FA mechanism relies on time-based OTP with a wide acceptance window or short-lived tokens, the attacker may achieve account compromise within minutes to hours of sustained brute-force attempts.