Myrezzta
Monthly
Remote, unauthenticated account takeover is possible in MyRezzta (AKIN Software) versions 2.06.03 through 2.07.00 because the application's forgotten-password recovery mechanism is implemented weakly (CWE-640). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, an attacker who can reach the account-recovery endpoint needs no credentials, no user interaction, and no special configuration, and can gain high confidentiality and integrity impact - effectively seizing control of targeted user accounts - with no availability impact. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, but the flaw is rated 9.1 and was reported by TR-CERT; the practical risk is concentrated on internet-exposed MyRezzta deployments within the affected version range.
Remote, unauthenticated account takeover is possible in MyRezzta (AKIN Software) versions 2.06.03 through 2.07.00 because the application's forgotten-password recovery mechanism is implemented weakly (CWE-640). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, an attacker who can reach the account-recovery endpoint needs no credentials, no user interaction, and no special configuration, and can gain high confidentiality and integrity impact - effectively seizing control of targeted user accounts - with no availability impact. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, but the flaw is rated 9.1 and was reported by TR-CERT; the practical risk is concentrated on internet-exposed MyRezzta deployments within the affected version range.