CVE-2026-57867
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in MicroRealEstate allows attackers to bypass authentication due to a lack of token state management. This enables brute-forcing One-Time Passwords (OTP) to log in as any user.
Risk Assessment
The risk is the potential takeover of any user account without knowing their password, leading to unauthorized access to data and system functions.
Recommendation
Immediately update MicroRealEstate to a version later than 1.0.0-alpha3 or apply a patch that introduces token state management and OTP attempt rate limiting.
Original NVD description (English source)
MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute-force One-Time Passwords (OTP) to log in as any user. This issue affects MicroRealEstate: through 1.0.0-alpha3.