The vulnerability results from inadequate protection against excessive authentication attempts, allowing an attacker to perform brute‑force login attempts. Successful exploitation permits account takeover, granting the attacker unauthorized access to the application and any data or functions available to the compromised user. This weakness falls under CWE‑307 – Authentication Bypass by Brute Force.

İdvlabs Software and Consulting Services Inc. Ontime versions through 2026‑10‑27 are affected. No specific patch levels are listed, and the vendor has not yet released a fix.

The CVSS score of 5.3 indicates a moderate severity. With no EPSS score available and no listing in CISA KEV, the exploitation probability is uncertain, but the potential for unauthorised access remains high. Likely attack is performed over the network via the application's authentication interface, though explicit vectors were not detailed in the advisory.