CVE-2026-57867
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in MicroRealEstate allows attackers to bypass authentication due to a lack of token state management. This enables brute-forcing One-Time Passwords (OTP) to log in as any user.
Risk Assessment
The risk is the potential takeover of any user account without knowing their password, leading to unauthorized access to data and system functions.
Recommendation
Immediately update MicroRealEstate to a version later than 1.0.0-alpha3 or apply a patch that introduces token state management and OTP attempt rate limiting.
Other vulnerabilities in MicroRealEstate
See all- CVE-2026-57871High
Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate through version 1.0.0-alpha3.
- CVE-2026-57870Medium
A broken object-level access control vulnerability in the Template API of MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization.
- CVE-2026-57869High
The vulnerability in MicroRealEstate stems from broken object-level access controls and the use of a deterministic pattern during random ID generation. This allows attackers to access documents uploaded by landlords or tenants without authorization.
- CVE-2026-57868High
MicroRealEstate is vulnerable to broken object-level access controls in its PDF generator functionality. This affects versions through 1.0.0-alpha3.
Original NVD description (English source)
MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute-force One-Time Passwords (OTP) to log in as any user. This issue affects MicroRealEstate: through 1.0.0-alpha3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS