Multiple BinSoft products implement client‑side authentication, meaning the application validates login credentials locally rather than on the backend. An attacker who gains the ability to modify any instance’s binary can alter this logic and authenticate as any user without providing valid credentials. This flaw allows an attacker to obtain arbitrary user access, potentially exposing confidential data and enabling lateral movement. The weakness is identified as CWE‑603. The vendor attributes the problem to its distribution architecture model and plans to correct it with an updated installation manual.

The vulnerability impacts all current BinSoft product releases, including mpCRM, mpFaktura, mpFirma, mpFirma ERP, mpGabinet, mpPOS, mpSekretariat, and mpWarsztat. Every published version contains client‑side authentication and is susceptible if the application binary can be tampered with; no version has been exempted, and the vendor has not yet released an update that removes the flaw.

The vulnerability carries a CVSS score of 8.4, indicating high severity. An EPSS score of 0.00192 (≈0.2 %) indicates a very low but nonzero likelihood of exploitation, and the lack of a KEV listing suggests no known large‑scale exploitation at this time. The likely attack vector involves an attacker with access to any instance of the affected BinSoft products that connects to the backend server; we infer that such access could be obtained either remotely through a public interface or locally by compromising a user’s machine. Once the binary is tampered with, the attacker can authenticate as an arbitrary user, leading to unauthorized system access.