CVE-2026-15586: OTP Brute-Force Account Takeover in Idvlabs Software's Ontime
Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Services Inc. Ontime allows Brute Force.
This issue affects Ontime: through 2026-10-27. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. An attacker would need to submit repeated authentication attempts against the affected Ontime service.
What is the likely impact of successful exploitation?
Successful brute-forcing can compromise account integrity, consistent with an account takeover scenario. The available data indicates no confidentiality or availability impact.
Are systems affected by default, and which versions are vulnerable?
The provided information identifies Ontime as affected through 2026-10-27, but it does not state whether a default configuration is vulnerable or identify a fixed version.
Is a vendor fix or workaround available?
No fix or workaround is described in the available information. The vendor was contacted early regarding the disclosure but did not respond.