ManageEngine Key Manager Plus versions before 7150 allow attackers with valid credentials to log in without providing a verification code. This bypass of the two‑factor authentication mechanism provides an attacker with full user access, increasing the risk of data exposure and malicious changes. The weakness is an improper authentication flaw (CWE‑288).

Zohocorp’s ManageEngine Key Manager Plus product is affected. Any installation running a version earlier than 7150 lacks the patch that enforces the second‑factor code during login.

The CVSS score of 7.4 indicates high severity, and while EPSS data is not available, the lack of KEV listing suggests no widespread, publicly known exploitation. The attack can be performed remotely by submitting a valid username and password, omitting the required verification code. An attacker with access to legitimate credentials can hijack an account and potentially gain full administrative control over the key management system.