CVE-2024-51558
This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.57%
- CWE
- CWE-307
- Published
- 2024-11-04
- Last modified
- 2026-03-13
Affected products
- Brokerage Technology Solutions Wave 2.0
Weakness type
Related vulnerabilities
- CVE-2026-88770 — Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts
- CVE-2026-78490 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-86729 — WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize
- CVE-2026-6223 — OTP Bypass in Bahçelievler Muncipality's BiHayat App
- CVE-2026-20514 — In Audio HAL, there is a possible information disclosure due to a missing permission check. This...
- CVE-2026-20512 — In Audio HAL, there is a possible escalation of privilege due to improper input validation. This...
- CVE-2026-86186 — AVideo API Rate Limit Bypass via Bot User-Agent Header
- CVE-2026-85237 — Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass