Description
This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses.

Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.
Published: 2025-02-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade RupeeWeb to version 66.9

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-4208 This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.
History

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00126}

 epss

{'score': 0.00141}

Sun, 13 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00236}

 epss

{'score': 0.00126}

Fri, 14 Feb 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 14 Feb 2025 11:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass Vulnerability in RupeeWeb trading platform Authentication Bypass Vulnerability in RupeeWeb trading platform

Fri, 14 Feb 2025 11:30:00 +0000

Type Values Removed Values Added
Description This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.
Title Authentication Bypass Vulnerability in RupeeWeb trading platform
Weaknesses CWE-302
References
Metrics cvssV4_0

{'score': 7.5, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-In

Published:

Updated: 2025-02-14T16:33:17.339Z

Reserved: 2025-02-12T11:42:37.480Z

Link: CVE-2025-26522

cve-icon Vulnrichment

Updated: 2025-02-14T16:33:13.477Z

cve-icon NVD

Status : Deferred

Published: 2025-02-14T12:15:29.583

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-26522

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses