Universal Software Inc. FlexCity/Kiosk contains an authentication bypass that permits an attacker to gain administrator access, effectively a privilege escalation. The vulnerability is classified as CWE-288, Improper Authentication, and the description indicates the attacker can bypass standard login procedures via an alternate path or channel. The description does not specify additional consequences beyond the elevated privileges.

Versión 1.0 up to but not including 1.0.36 of FlexCity/Kiosk is affected. Deployments running any of these versions are susceptible to the authentication bypass, according to the vendor’s notice.

The CVSS score is 8.8, indicating a High severity rating. The EPSS score is listed as less than 1%, implying a very low probability of exploitation at the time of this assessment. The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack path involves using an alternate authentication route that bypasses the standard login, requiring only access to the application and no privileged credentials.