Technical impact
Vantage6 allows resetting the MFA token through API routes that send reminder emails. The service does not enforce a limit on the number of emails sent, so an attacker who can provide a valid password could trigger hundreds or thousands of emails to a target’s mailbox. While each email requires a correct password, the attack does not compromise credentials or confidentiality. The consequence is primarily a disruption to the target's mail flow and potential abuse of the SMTP server as a spam source, reflecting a low-impact denial‑of‑service scenario. The weakness corresponds to CWE‑400, an Uncontrolled Resource Consumption flaw.
Affected Systems
The issue affects the Vantage6 platform implemented by the vendor Vantage6 before version 5.0.0. The 5.0.0 release and later versions contain a fix that imposes a limit on reset‑related emails.
Risk and Exploitability
The CVSS score of 2.1 indicates a low severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to know a valid user password; therefore, credential compromise is a prerequisite. Given the low probability of exploitation and the minimal impact, the overall risk to systems that have not yet applied the patch is limited.
Github GHSA