Flip EUVD-2026-16818

The CVSS v4.0 score of 2.7 reflects a network-accessible vulnerability with low complexity (AC:L), no authentication required (PR:N), and limited integrity impact (VI:L) but no confidentiality or availability impact. The EPSS and KEV status are not provided, and no public exploit code has been independently referenced in available data. However, risk assessment must account for multiple factors: (1) brute-force attacks against authentication systems are highly automatable and do not require sophisticated tooling, making real-world exploitation probability high despite low CVSS; (2) the attack requires no user interaction and operates at the network layer, removing barriers to exploitation; (3) the target user base consists of external healthcare professionals with high credential reuse likelihood, increasing the utility of successful compromise; (4) as a medical imaging AI platform, compromised accounts could enable tampering with training datasets or model integrity across multiple healthcare institutions. The low CVSS score underestimates practical risk-this is a high-priority vulnerability for environments handling sensitive healthcare data despite formal severity metrics.

An attacker obtains a list of email addresses of FLIP users from public healthcare institution employee directories or conference registrations, then uses automated tools to attempt password guesses against the FLIP login endpoint. Because the platform lacks rate limiting, the attacker can submit thousands of credential combinations per hour without triggering account lockout or IP-based blocking. Upon successful compromise of a user account (especially administrative or research lead roles), the attacker gains access to federated training datasets, model weights, or institutional affiliations within the medical imaging AI pipeline, potentially enabling data exfiltration, model poisoning, or lateral movement to connected healthcare systems.