Liman MYS CVE-2026-94380

Exploitation targets the forgotten-password / account-recovery feature of Liman MYS versions 2.3.4-1124 up to (not including) 2.3.5-1131; an attacker must be able to reach that recovery workflow over the network (AV:N) and no attacker authentication is required (PR:N). The key limiting factor is UI:R: the attack requires user interaction to succeed and is not fully autonomous, so it depends on a victim performing some recovery-related action rather than being exploitable purely at the attacker's initiative. The specific mechanism weakness (e.g. token predictability or validation gap) is not described in the available sources. Availability is unaffected (A:N); impact is confined to takeover of the targeted account's data (C:H/I:H).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity flaw needing no attacker privileges but requiring user interaction (UI:R), with high confidentiality and integrity impact and no availability impact - consistent with an account-takeover via a weak forgotten-password flow (CWE-640). The vuln.today decision label is 'this_week', indicating elevated but non-emergency urgency. No EPSS score, no CISA KEV listing, and no POC/exploit reference are present in the input, so there is no public exploitation signal to corroborate the high base score; the single reference is the TR-CERT (Turkish national CERT / USOM) advisory, which is a credible authoritative source for discovery and patch details but not evidence of in-the-wild use. The practical risk is therefore driven by severity and the fact that it affects an account-recovery mechanism (high value to attackers) rather than by any demonstrated exploitation. The UI:R requirement is a meaningful limiter - the attack is not fully autonomous - and because Liman MYS is a niche, regionally-deployed product, this reads as a genuine but not internet-wide priority: patch within the vendor/CERT-indicated window rather than treat as an active emergency. Note the tag 'Information Disclosure' understates the impact, since the vector also records I:H (integrity), implying account takeover, not merely disclosure.

An unauthenticated attacker abuses weaknesses in the Liman MYS forgotten-password flow (CWE-640) - for example a predictable or improperly validated reset token/flow - to hijack the recovery process and take over a targeted user account, gaining access to its data and the ability to alter it (C:H/I:H). The UI:R metric indicates the attack depends on some user interaction (such as a victim following a reset-related link or action) to complete. No public exploit or POC is identified in the available data, so exploitation would require the attacker to independently reconstruct the flaw from the advisory and patch.