The vulnerability allows unlimited password guesses against both the web browser login flow and the JSON API endpoint in dataCycle-CORE versions 25.07.3 and earlier. Because the Devise :lockable module is disabled and no rate‑limiting or lockout strategy is enforced, attackers can continuously attempt credentials until success. A successful guess yields a functioning session cookie for web access or a fresh JWT for API usage, enabling complete account takeover. The weakness is a direct online password‑guessing risk with real potential for credential abuse. This represents a significant threat to account confidentiality and integrity.

The affected product is dataCycle-CORE from datacycle‑engine. Versions up to and including 25.07.3 are vulnerable. All deployments using these or older releases are at risk, regardless of deployment size or environment. The root of the issue lies in the user model configuration where lockable features are explicitly turned off.

With a CVSS score of 7.3, the vulnerability is considered high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, so current known exploitation data is limited. However, the lack of any temporary lockout or request throttling means that a remote attacker with network access can attempt continuous guesses over /users/sign_in and /api/v4/auth/login endpoints. The API endpoint is particularly attractive because it does not require a CSRF token, allowing fully automated brute‑force tooling. Because each successful guess grants a valid session token, the attacker can immediately hijack the target account.