An exploit in Systrome Validation & Certification 1.0 enables an attacker to trigger a denial of service by manipulating the t URL parameter in the qrcode_auth.html component. The vulnerability allows the attacker to send a crafted request that causes the application to become unresponsive, thereby interrupting service availability for legitimate users. The description does not explicitly state the attack vector; it is inferred that a remote attacker can exploit this via a network request to the vulnerable endpoint with a malicious t value.

The flaw affects Systrome Validation & Certification version 1.0 only. No other vendors or product versions are listed as impacted.

EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating a relatively low likelihood of exploitation. Attackers could exploit this by accessing the vulnerable endpoint over the network and supplying a malicious t value. The attack vector is inferred from the description, as it is not directly stated. With a CVSS score of 4.3, the severity is considered low, so the risk is primarily mitigated through operational controls and monitoring.