A weakness in the TEİAŞ Mobile Application allows an attacker to hijack a user's session by exploiting insufficient session expiration controls. This flaw enables the attacker to impersonate a valid user and potentially gain unauthorized access to the application’s functions, compromising confidentiality and integrity of user data. The identified weakness aligns with CWE-613, which describes authentication and session management flaws.

Turkiye Electricity Transmission Corporation’s Mobile Application, versions prior to 1.13, including 1.6.2 and all intervening releases, is impacted.

The CVSS score of 5.7 indicates a medium severity vulnerability. No EPSS score is available, so the likelihood of exploitation is uncertain but potentially higher in environments where the application is widely used. The issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, exploiting the application layer where session tokens are transmitted or stored. An attacker who can capture a session token—through network interception or social engineering—could maintain unauthorized access until the session expires.