CVE-2025-41459CWE-287

Insecure authentication due to missing bruteforce protection and runtime manipulation in Two App Studio Journey 5.5.6 for iOS

High · published July 21, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN attempts or dynamic code injection.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00186 · 7.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-07-21T11:01Z
EPSS history
Timeline
  • 21 JUL 11:01Z
    Insecure authentication due to missing bruteforce protection and runtime manipulation in Two App Studio Journey 5.5.6 for iOS
    cvelistv5