A missing authorization check in Genian SSL PNS allows an attacker to manipulate the login request parameter and bypass the multi‑factor authentication requirement. This flaw is a classic example of CWE‑862, *Broken Access Control*, where an unauthorized user can gain authenticated access without completing all required authentication steps. The result is the potential for an attacker to obtain user privileges and access protected resources without proper verification.

The vulnerability affects Genians, Inc’s Genian SSL PNS (frodo‑core) product. The advisory does not list specific version ranges, but the recommended fix is to upgrade to version 5.0.0. Any deployment of older releases that still implement the original login flow is potentially exploitable.

The CVSS v3.1 score is 7.3, indicating a high severity for an authentication bypass. The EPSS score is unavailable, so the current exploitation probability is unknown, and the issue is not listed in CISA’s KEV catalog. The likely attack vector involves a remote attacker sending a crafted login request to the authentication endpoint, modifying a parameter that the system incorrectly trusts. Because the flaw directly removes MFA enforcement, compromised accounts could be used for lateral movement or data exfiltration if not mitigated.