The vulnerability is an authorization bypass through a user‑controlled key. PAVO Pay allows an authenticated user to supply a key that is not tied to their own identity, thereby circumventing the system’s authorization checks. An attacker can present a trusted identifier belonging to another user to access data or perform actions that should be restricted, leading to unauthorized information disclosure or transaction manipulation. The flaw is categorized as CWE‑639.

This issue affects PAVO Financial Technology Solutions Inc.’s PAVO Pay product. Versions up to and including 09072026 are vulnerable; vendors other than PAVO Financial Technology Solutions Inc. are not implicated.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, so it has not yet been widely exploited. The most likely attack vector is inferred to be via manipulated HTTP requests, where the user supplies a user‑controlled key; the description does not detail a more specific exploitation method.