Ekko Studio through version 0.7.36 contains a missing‑authorization flaw that allows any authenticated user who is not a super_admin to access the /api/auth/locked‑ips endpoint. By sending DELETE requests without an ip parameter, the attacker can invoke the unlockAll() function, which disables the login rate limiter. This action enables password‑guessing attempts against super_admin accounts to proceed without the usual protection, effectively bypassing authentication safeguards.

The affected product is Ekko Studio from Ekko Learn AI, with the vulnerability present in all releases up to and including 0.7.36. No other vendor or product versions are listed as affected.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be exercised only by an authenticated non‑super_admin user, the attack vector is inferred to be an authenticated API request within the application. Once exploited, the attacker can remove rate‑limiting constraints and launch accelerated brute‑force attacks against super_admin credentials. The risk is therefore moderate but can become critical if an attacker already has a user account and targets privileged accounts.