CVE-2025-26524

MEDIUM

RupeeWeb < 66.9 - Authenticated OTP Flooding via Missing Rate Limiting

Title source: llm

Description

This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/ flooding on the targeted system.

References (1)

Core 1

Core References

Various Sources third-party-advisory

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020

Scores

CVSS v4 5.1

EPSS 0.0042

EPSS Percentile 32.9%

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-799

Status published

Products (1)

Rupeeseed Technology Ventures/RupeeWeb <66.9

Published Feb 14, 2025

Tracked Since Feb 18, 2026