CVE-2020-10876

HIGH

OKLOK 3.1.1 - Insufficient Session Expiration via Verification Code Brute Force

Title source: llm
STIX 2.1

Description

The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification code that is required for resetting passwords, nor does it properly restrict excessive verification attempts. This allows an attacker to brute force the four-digit verification code in order to bypass email verification and change the password of a victim account.

References (2)

Core 2
Core References
Product, Third Party Advisory x_refsource_misc
https://apps.apple.com/us/app/oklok/id1392287771
Exploit, Third Party Advisory x_refsource_misc
https://github.com/fierceoj/ownklok

Scores

CVSS v3 7.5
EPSS 0.0107
EPSS Percentile 60.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-613 CWE-307
Status published
Products (1)
oklok_project/oklok 3.1.1
Published May 04, 2020
Tracked Since Feb 18, 2026