Description

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-09-07T13:20:33.977Z",
  "pubdate": "2026-09-07T13:20:33.977Z",
  "executiveSummary": "The Bahçelievler Muncipality BiHayat App is affected by an improper restriction of excessive authentication attempts vulnerability, categorized under CWE-307.\nThis flaw allows an attacker to conduct brute-force or credential stuffing attacks against authentication mechanisms without triggering rate-limiting or account lockout protections.\nThe vulnerability directly results in an Authentication Bypass, permitting unauthorized access to user accounts or administrative interfaces.\nThe affected product, BiHayat App, is vulnerable in versions from 2.1.7 through 07092026.\nThe risk is critical, as the lack of defense against automated authentication attempts grants remote attackers the ability to compromise accounts through sustained, high-volume trial-and-error techniques.\nAs the vendor has remained unresponsive to disclosure, no official patch is currently identified, leaving installations exposed to exploitation by threat actors capable of automating login requests.",
  "technicalDetails": "The vulnerability resides in the authentication logic of the BiHayat App, which fails to adequately implement or enforce rate-limiting and account lockout policies during the authentication process.\nRoot Cause: The application lacks a security control mechanism to track, limit, or throttle repeated authentication requests originating from the same source, such as an IP address or session identifier, over a defined temporal window. This allows an attacker to submit an unlimited volume of authentication attempts in rapid succession.\nAttack Flow: An attacker targets the application's login endpoint. By utilizing automated tools, the attacker scripts thousands of credential pairs per minute. Because the backend does not monitor for failed attempts or enforce an exponential backoff strategy, the server continues to process each request synchronously. If the password policy is weak or if common credential combinations are used, the attacker will eventually successfully authenticate as a valid user.\nExploitation Method: This is a classic brute-force or dictionary attack enabled by the absence of programmatic restrictions. An attacker may distribute these attempts across a proxy network to evade basic IP-based blocking if they were to exist. Given the absence of enforced delays, the application remains fully susceptible to high-speed automated exploitation.\nAffected Versions: BiHayat App versions 2.1.7 through 07092026 are confirmed to be impacted.\nPrivilege Requirements: No pre-existing authentication or privileged access is required to initiate the attack; it is performed externally against the public-facing authentication interface.\nPost-Exploitation Impact: Successful exploitation results in complete Authentication Bypass, granting the attacker full access to the victim's account privileges. Depending on the targeted account, this may result in unauthorized access to sensitive personal data, municipality service information, or administrative functionalities within the BiHayat application ecosystem."
}