Description
Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation.

This issue affects FlexCity: from 5.536.0 before 5.542.0.
Published: 2026-07-21
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The updated description indicates that Universal Software Inc. FlexCity suffers from improper restriction of excessive authentication attempts, potentially allowing an attacker to repeatedly try authentication without limit. This can lead to bypassing the one‑time password mechanism and gaining unauthorized access, which aligns with CWE‑307.

Affected Systems

Universal Software Inc. FlexCity versions 5.536.0 up to, but not including, 5.542.0 are affected.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate risk, and the EPSS score of less than 1% suggests a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, based on the description that repeated authentication attempts could be made over a network connection to the FlexCity application.

Generated by OpenCVE AI on August 4, 2026 at 05:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FlexCity to the latest release that addresses the authentication attempt limit issue
  • If an immediate update is not possible, configure server‑side rate limiting per user session
  • Contact Universal Software Inc. for an official patch or guidance on temporary mitigations

Generated by OpenCVE AI on August 4, 2026 at 05:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 through 11052026. Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 before 5.542.0.

Mon, 27 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Universal Software Inc.
Universal Software Inc. flexcity
Vendors & Products Universal Software Inc.
Universal Software Inc. flexcity

Tue, 21 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 through 11052026.
Title OTP Bypass in Universal Sotware's FlexCity
Weaknesses CWE-307
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Universal Software Inc. Flexcity
cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-07-28T11:34:01.783Z

Reserved: 2026-05-11T06:58:58.943Z

Link: CVE-2026-8285

cve-icon Vulnrichment

Updated: 2026-07-21T16:18:13.311Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T06:00:05Z

Weaknesses
  • CWE-307

    Improper Restriction of Excessive Authentication Attempts