CVE-2026-15586
OTP Brute-Force Account Takeover in Idvlabs Software's Ontime
İdvlabs Software and Consulting Services Inc. Ontime
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Description
Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Services Inc. Ontime allows Brute Force.
This issue affects Ontime: through 2026-10-27. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Text from CVE List
Affected versions 1
- Ontimeaffected: all versions through 2026-10-27CVE List