EUVD-2026-42003
GHSA-j5cw-4r7c-4vw8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated OTP brute-force with no state limits gives AV:N/AC:L/PR:N/UI:N; account takeover yields C:H, limited data modification I:L, no availability impact.
Primary rating from Vendor (themissinglink).
CVSS VectorVendor: themissinglink
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute-force One-Time Passwords (OTP) to log in as any user. This issue affects MicroRealEstate: through 1.0.0-alpha3.
AnalysisAI
Authentication bypass in MicroRealEstate (open-source property/real-estate management platform) through version 1.0.0-alpha3 lets remote unauthenticated attackers brute-force the One-Time Password (OTP) login flow to authenticate as any user. Because the OTP tokens are not tracked in server-side state, codes are not invalidated or rate-limited across attempts, collapsing the effective keyspace and enabling account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target MicroRealEstate instance (through 1.0.0-alpha3) be network-reachable and use the OTP-based login flow, and that the attacker can identify a valid target account/identifier to request an OTP for; the enabling defect is the absence of OTP state management (no single-use invalidation, no expiry enforcement, no attempt rate-limiting), which permits unlimited guessing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L, base 8.8) indicates a network-reachable, low-complexity, unauthenticated attack yielding high confidentiality impact, which aligns with the described unlimited OTP brute-force leading to account takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who knows or enumerates a valid account identifier (e.g. a landlord or tenant email) triggers the OTP login flow, then submits automated, high-volume OTP guesses against that account. … |
| Remediation | No vendor-released patched version is identified in the provided data (the affected range is 'through 1.0.0-alpha3' with no fix version stated), so the primary action is to consult the reporter advisory at https://www.themissinglink.com.au/security-advisories/cve-2026-57867 and the upstream project at https://github.com/microrealestate/microrealestate for a patched release or commit and upgrade to it once confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running MicroRealEstate ≤1.0.0-alpha3; implement rate limiting on OTP endpoints (e.g., maximum 3 attempts per minute per IP address); enable comprehensive audit logging of all authentication attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today