Improper restriction of excessive authentication attempts in the BiHayat App allows an attacker to bypass the OTP verification that is intended to authenticate users. This flaw can enable an unauthorized party to access accounts or services protected by two‑factor authentication, compromising both confidentiality and integrity. The weakness maps to CWE-307, illustrating a failure to enforce authentication policy.

The affected product is the BiHayat App distributed by Bahçelievler Muncipality. All releases from version 2.1.7 through 07092026 contain the flaw. No fixed release is currently available.

The CVSS score of 9.4 places this vulnerability in the Critical range, indicating that a successful exploitation would give attackers total control over authentication. Although the EPSS score is unavailable, the absence of a CISA KEV listing does not reduce the likelihood that attackers will target the app; the flaw permits a straightforward bypass with minimal effort, as no special privileges or pre‑condition actions are described. The attack vector is likely remote and can be performed from within the mobile application, without the need for physical access to the device.