The Telecommunication of Turkey Electricity Transmission Corporation (TEİAŞ) Mobile Application contains an improper restriction of authentication attempts error that allows an attacker to perform a brute force attack against the one‑time password (OTP) entry. The vulnerability is a classic example of CWE‑307: Improper Restriction of Excessive Authentication Attempts, and could allow an attacker to guess or force a valid OTP and gain unauthorized access to the application, potentially exposing sensitive user data or functionality. It does not directly provide code execution but violates confidentiality and integrity by circumventing the intended authentication mechanism.

TEİAŞ Mobile Application versions from 1.6.2 up to, but not including, 1.13 are impacted. Versions 1.13 and later are not affected.

The CVSS score of 6.3 indicates a moderate severity vulnerability, yet an attacker can exploit it by sending repeated OTP attempts from a client device. The EPSS score is not available, so current exploitation probability is unknown, but the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits. The attack vector is presumed to be client‑side or over an open network connection, requiring access to the mobile application interface. Exploitation also requires minimal prior information about the target credential or OTP payload, making it potentially high‑impact if unchecked.