A vulnerability in the two‑factor authentication module of CodeWise Tornet Scooter Mobile App 4.75 on iOS and Android allows an attacker to bypass the normal restriction on excessive authentication attempts. This improper limitation enables the attacker to attempt repeated logins from a remote location, potentially leading to account compromise. The flaw aligns with CWE‑307 (Improper Restriction of Excessive Authentication Attempts) and CWE‑799 (Authentication Bypass).

The affected product is CodeWise Tornet Scooter Mobile App version 4.75, both on iOS and Android platforms. The issue originates in an unknown function within the file /TwoFactor and is observable when the app is installed on target devices.

The CVSS score is 6.3, indicating a medium risk, and the EPSS score is not available, so the likelihood of exploitation cannot be quantified; the vulnerability is not in CISA’s KEV catalog. It can be exploited remotely, and is described as complex and difficult, but because the flaw permits repeated authentication attempts it still poses a meaningful threat until a vendor fix is issued.