CVE-2025-63807
CriticalSummary
The university-bbs (Blogin) system has a weak verification code generation mechanism and lacks rate limiting. This allows an attacker to perform brute-force attacks on verification codes without authentication. Successful exploitation may lead to account takeover via password reset or other authentication bypass methods.
Risk Assessment
Risk of account takeover, potentially leading to unauthorized access to data and compromise of system integrity.
Recommendation
Strengthen the verification code generation mechanism and implement rate limiting for verification-related operations.
Original NVD description (English source)
An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without authentication. Successful exploitation may result in account takeover via password reset or other authentication bypass methods.