Improper restriction of excessive authentication attempts in the Bahçelievler Muncipality BiHayat App removes the security safeguards around its one‑time‑password (OTP) verification. The flaw allows an attacker to repeatedly attempt or overly frequent OTP challenges so that the system accepts a valid OTP without properly confirming the user’s identity. The result is an authentication bypass that enables unauthorized access to user accounts and associated services, compromising the confidentiality and integrity of the data managed by the application. The weakness pertains to failure to enforce authentication policies correctly, classified as CWE‑307.

The BiHayat App distributed by Bahçelievler Muncipality is affected. All releases from version 2.1.7 up to, but not including, version 2.3 contain the flaw; version 2.3 and later incorporate the fix.

The CVSS score of 9.4 places this vulnerability in the Critical range, indicating that a successful exploitation would give attackers full control over the authentication process. Although the EPSS score is less than 1 %, the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker can perform the bypass remotely via the mobile application, without requiring physical access or special privileges, by exploiting the lack of rate‑limiting on OTP requests.