A flaw in the login.php script of the AdithyaYelloju Restaurant‑Management‑System constitutes a CWE‑287: Improper Authentication vulnerability, allowing attackers to manipulate email and password arguments, leading to improper authentication. This means that correct credentials may not be required and valid or invalid login attempts can be bypassed, granting unauthorized users access to the system’s protected functionality.

The vulnerability affects the open‑source Restaurant‑Management‑System developed by AdithyaYelloju. No specific release numbers are published because the project follows rolling releases, but the code prior to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c is known to be vulnerable. Users running any unpatched version that still contains this version of login.php are at risk.

The CVSS score of 6.9 indicates medium severity, and the EPSS score is unavailable, so the exact likelihood of exploitation is not quantified. This vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be performed remotely through the web interface, requiring only the ability to send HTTP requests to the login page. An attacker who can exploit this flaw could gain unauthorized access to the application, potentially reading or modifying sensitive data and compromising the entire system.