The vulnerability is an authentication bypass that uses an alternate path or channel to grant an attacker administrative privileges. Classified as CWE-288 Improper Authentication, the flaw allows bypassing the standard login and escalating to a privileged role. No additional consequences beyond the elevated privileges are reported in the description.

Versión 1.0 up to but not including 1.0.36 of FlexCity/Kiosk is affected. Deployments running any of these versions are susceptible to the authentication bypass, according to the vendor’s notice.

The CVSS score is 8.8, indicating a High severity rating. The EPSS score is listed as less than 1%, implying a very low probability of exploitation at the time of this assessment. The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack path involves using an alternate authentication route that bypasses the standard login, requiring only access to the application and no privileged credentials.