CVE-2025-1928CWE-307

Improper Authentication in Restajet's Online Food Delivery System

Critical · published December 19, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

🚨 A vulnerability in Restajet’s Online Food Delivery System lets attackers exploit a flaw in password recovery — talk about an open door for mischief! 🔥 Think of it like a restaurant that keeps re-sending the same order without checking who’s asking for more — a recipe for chaos! When the system fails to limit excessive password recovery attempts, it allows attackers to exploit this oversight. An attacker could flood the password recovery feature with requests, potentially gaining unauthorized access to user accounts, stealing personal information, and even misusing payment details. The fallout could lead to compromised accounts across the board, putting all users at risk and causing absolute havoc!

Put simply

Think of it like a restaurant that keeps re-sending the same order without checking who’s asking for more — a recipe for chaos! When the system fails to limit excessive password recovery attempts, it allows attackers to exploit this oversight. This vulnerability allows attackers to bypass restrictions on password recovery attempts, making it possible to exploit the system and gain access without proper authentication checks.

What to do

An attacker could flood the password recovery feature with requests, potentially gaining unauthorized access to user accounts, stealing personal information, and even misusing payment details. The fallout could lead to compromised accounts across the board, putting all users at risk and causing absolute havoc! Immediate action is crucial! Implement rate limiting on password recovery requests to prevent abuse, and notify users to use strong, unique passwords. Additionally, review the security protocols to ensure there are no other overlooked vulnerabilities. Patch any affected components promptly! You've got this! Secure your system, protect your users, and keep the bad guys at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00364 · 29.1th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-12-19T12:08Z
EPSS history
Timeline
  • 19 DEC 12:08Z
    Improper Authentication in Restajet's Online Food Delivery System
    cvelistv5