The vulnerability originates from an absence of limits on the /Account/resetPwd endpoint, allowing an attacker to trigger an unlimited number of password reset emails for a single account. This flaw permits automated abuse of the password recovery process, resulting in a flood of emails to the target user and the potential for resource exhaustion on both the application and email servers. The impact is primarily a denial of legitimate email traffic and an increased cost burden on infrastructure, with no direct compromise of data or system integrity. The weakness is a classic case of excessive resource consumption, documented as CWE-770.

The flaw affects AM System’s ALO Suite, as identified by the CPE string cpe:2.3:a:am_system:alo_suite:25_09_15.03_35. The vendor has released a fix in version 26_04_15.03_10, which addresses the missing request limits. Users of earlier releases, such as 25_09_15.03_35, remain susceptible to the exploitation until they upgrade to the patched version.

The CVSS score of 6.9 indicates medium severity for this vulnerability. The EPSS score is not available, suggesting no current data on exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, implying that no widespread or publicly known exploits are recorded. An attacker can exploit the flaw remotely by repeatedly invoking the reset endpoint, with minimal prerequisites such as an account identifier. Because the flaw allows unlimited requests, the risk of abuse is high for any user with a valid account on the affected system.