The flaw exists within the account_verification function of cleverange_auth v.0.1.10, allowing a remote actor to repeatedly invoke the function and exhaust system resources, resulting in a denial of service. The vulnerability is an uncontrolled resource consumption issue, as the function does not properly validate or limit input, enabling an attacker to trigger a crash or hang.

Python applications that incorporate the cleverange_auth library at version 0.1.10 are directly impacted. Any deployment where this package is used to expose an account verification endpoint is vulnerable, regardless of additional infrastructure.

The EPSS score of less than 1% indicates a very low probability of exploitation, and the CVSS score of 7.5 classifies the vulnerability as high severity, with the vulnerability not being listed in CISA KEV. However, the remote nature of the DoS attack, coupled with the ability to launch it through a publicly reachable endpoint, indicates a potential for disruption. Based on the description, the attacker appears not to require privileged credentials, only access to the account_verification route until a patch is applied.