LatePoint EUVD-2026-103217

Exploitation requires: (1) the LatePoint OTP/passwordless login flow being in use on the site; (2) the attacker knowing the target customer's registered email address or phone number (identifier enumeration is the key gating factor); and (3) the ability to send many concurrent requests to the auth__verify_otp endpoint to win the read-modify-write race on the attempts counter. The otp_verify_otp_nonce is NOT a limiting factor because it is publicly emitted by the unauthenticated request_otp and resend_otp endpoints. Limiting factors that reduce real-world risk: the attacker must target a specific known customer (no blind mass exploitation), must reliably win a timing race against the non-atomic counter update, and must still brute-force the 6-digit code within the race window; sites not using LatePoint's OTP authentication are unaffected.

This is a serious, credible flaw backed by a clear, code-level root-cause analysis from Wordfence (a reputable WordPress security vendor) with direct source links to the vulnerable verifyOTP logic, so the technical validity is high-confidence. The input CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H) reflects unauthenticated, network-reachable account takeover. However, I flag a conflict in the complexity rating: the vulnerability is a TOCTOU race condition, and winning a race plus brute-forcing a 6-digit OTP realistically warrants AC:H rather than the AC:L in the supplied vector - the headline 9.1 may slightly overstate reliability, though defeating a lockout via concurrency is repeatable. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of in-the-wild exploitation; this currently reads as a high-CVSS issue without confirmed active abuse. The practical risk is tempered by a real precondition absent from the raw vector - the attacker must already know a target customer's registered email or phone number - which makes this better suited to targeted account compromise than opportunistic mass exploitation. Net: treat as a high-priority patch for any site running LatePoint's OTP login, but current exploitation likelihood is unproven.

An attacker who knows a LatePoint customer's registered email or phone number first harvests the public OTP nonce from the unauthenticated request_otp/resend_otp endpoints, then fires many concurrent auth__verify_otp requests so the non-atomic attempts counter never trips the 10-attempt lockout. With the lockout defeated, they brute-force the 6-digit OTP and log in as the victim, accessing their bookings and personal data. No public exploit code was identified at time of analysis, and exploitation requires winning a timing race rather than a single deterministic request.