CVE-2025-1740CWE-307

Authentication Bypass in Akinsoft's MyRezzta

Critical · published September 3, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

🔥 A simple brute-force attack is all it takes to bypass authentication in Akinsoft MyRezzta — like leaving the front door wide open for intruders! Imagine a hotel front desk that doesn't lock its doors at night, allowing anyone to walk in and use any guest's room key without checking identification. This vulnerability lets attackers try countless passwords without consequence, making it alarmingly easy to gain unauthorized access. An attacker could exploit this vulnerability to bypass authentication entirely, access sensitive accounts, and even reset passwords at will. With such power, they could steal valuable data or wreak havoc on user accounts, making this a nightmare scenario for any affected organization!

Put simply

Imagine a hotel front desk that doesn't lock its doors at night, allowing anyone to walk in and use any guest's room key without checking identification. This vulnerability lets attackers try countless passwords without consequence, making it alarmingly easy to gain unauthorized access. This vulnerability allows an attacker to bypass authentication controls due to improper restrictions on excessive login attempts, enabling brute-force attacks to succeed without triggering account lockout mechanisms.

What to do

An attacker could exploit this vulnerability to bypass authentication entirely, access sensitive accounts, and even reset passwords at will. With such power, they could steal valuable data or wreak havoc on user accounts, making this a nightmare scenario for any affected organization! Immediately update MyRezzta to version 2.05.01 or later to patch this flaw. Additionally, implement account lockouts or CAPTCHA after a set number of failed login attempts to bolster security against brute-force attacks. Regularly review authentication mechanisms to ensure best practices are followed. You've got this! By staying proactive and following these steps, you'll strengthen your defenses and keep your users safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-09-03T08:52Z
EPSS history
Timeline
  • 03 SEP 08:52Z
    Authentication Bypass in Akinsoft's MyRezzta
    cvelistv5