CVE-2026-15586 PUBLISHED

OTP Brute-Force Account Takeover in Idvlabs Software's Ontime

Assigner: TR-CERT
Reserved: 13.07.2026 Published: 27.10.2026 Updated: 27.10.2026

Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Services Inc. Ontime allows Brute Force.

This issue affects Ontime: through 2026-10-27.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 5.3

Product Status

Vendor İdvlabs Software and Consulting Services Inc.
Product Ontime
Versions Default: unaffected
  • affected from 0 to 2026-10-27 (incl.)

Credits

  • Berat ARSLAN finder

References

Problem Types

  • CWE-307 Improper restriction of excessive authentication attempts CWE

Impacts

  • CAPEC-112 Brute Force