MCO’s password reset flow automatically clears the existing password and any temporary tokens whenever a reset request is made. The flow does not enforce rate limiting or additional verification beyond the security question, which an attacker can answer if they know the victim’s email and the correct answer. Each successful reset invalidates the victim’s current credentials, allowing the attacker to repeatedly trigger resets and eventually lock the account out. This flaw corresponds to CWE‑307 (Improper Restriction of Authentication Attempts) and CWE‑640 (Improper Management of Password Reset Tokens).

Customers of MyComplianceOffice’s MCO application who are running version 25.3.3.1 have been confirmed vulnerable. Other releases may also be affected until a vendor patch is issued.

The CVSS score of 6.3 indicates moderate severity, while an EPSS score of less than 1 % reflects a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attacker must obtain the victim’s email and correctly answer the security question, then submit repeated reset requests within the limited number of security‑question attempts to lock the account. The likely attack vector is the publicly exposed password‑reset endpoint of MCO. Even though the attempt limit reduces the window for abuse, the vulnerability still permits a denial of service attack against the victim’s account.