Apache Answer exposes email‑based verification workflows that are intended to differentiate between distinct account operations. The flaw stems from a missing enforcement of the verification code’s purpose, allowing a code issued for one workflow to be reused for a different, more privileged workflow. As a result, an attacker who obtains or guesses a valid verification code could bypass the intended verification step and gain unauthorized access to a user’s account. This constitutes a direct account takeover risk and is classified as a missing access control flaw (CWE-863).

All installations of Apache Answer version 2.0.2 or earlier are vulnerable. The Apache Software Foundation’s advisory indicates the issue is corrected in version 2.0.3. The product is distributed as part of the Apache Answer stack.

It is inferred that no public exploits have been reported; the EPSS score is <1%, indicating a very low probability of exploitation. The CVSS score of 5.4 indicates moderate severity, and the low EPSS suggests a low likelihood of exploitation. Because the attack relies on a simple reuse of a code that should be context‑specific, the barrier to exploitation is low, resulting in a moderate risk to user accounts.