The vulnerability stems from using an insecure cryptographic algorithm on MIFARE Classic NFC wristbands issued by CasfID Servicios Tecnológicos. The weakness allows an attacker to recover access keys via a Backdoored Nested Attack, read all data stored on the wristband, and clone its credentials onto a compatible rewritable card. The resulting unauthorized cloning enables the impersonation of attendees, the misuse of the balance associated with the wristband, and financial loss to both users and event organizers. The weakness is a form of cryptographic weakness described by CWE‑326.

CasfID Servicios Tecnológicos supplies NFC wristbands based on the MIFARE Classic family, specifically the FM11RF08S variant used at Resurrection Fest 2025. No other product versions are listed as affected.

The CVSS score of 6.8 and an EPSS score of less than 1 % indicate a moderate severity and low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves proximity access via NFC; an attacker with a compatible reader can exploit the weak authentication algorithm to extract keys and clone cards, potentially compromising financial transactions. The overall risk is moderate, with the primary impact being unauthorized access and financial theft.