This vulnerability resides in NT OneAPP developed by NewType Infortech. An unauthenticated local attacker can trigger a deep link that bypasses the app’s PIN lock, thereby gaining access to the resources of a currently logged‑in user. The flaw permits acquisition of protected data without proper authentication, effectively allowing the attacker to impersonate the user within the application.

The affected product is NT OneAPP from NewType Infortech. Version specifics are not disclosed in the advisory, so any installed instance of this application could be vulnerable unless a fix has been applied. Users should verify whether their deployment runs NT OneAPP and determine if it is current.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation activity. The attack vector is local, relying on the presence of a deep link constructed by the attacker. Once the PIN lock is bypassed, the attacker can read or modify the user’s data within the application. Because the flaw does not require additional authentication credentials, local users or anyone able to invoke the deep link can exploit it.