The vulnerability stems from an improper restriction of excessive authentication attempts in the Pause+ Mobile App, enabling an attacker to bypass the one‑time password (OTP) verification process. Exploitation lets an unauthorized user gain access to a target account without submitting a valid OTP, thereby compromising account confidentiality and potentially revealing sensitive user data or transactional information. The flaw corresponds to CWE‑307 and is quantified with a CVSS score of 9.8, indicating a critical potential for exploitation.

Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. has identified the Pause+ Mobile App as affected. Any deployment of the app from version 1.0.6 up to, but not including, 1.5 is vulnerable. Versions prior to 1.0.6 are assumed secure, and 1.5 or newer contain the fix.

The CVSS score of 9.8 marks this issue as a high‑severity authentication bypass that could be leveraged remotely via the app’s authentication API. While EPSS data is not available, the lack of an EPSS score does not diminish the risk; the flaw is actively disclosed in a security advisory and is not cataloged in the CISA KEV list. Attackers can trigger the bypass by sending crafted authentication requests that reset or ignore OTP checks, thereby achieving privileged access without further authorization.