Rising Technosoft CAP Back Office Application OTP Verification Bypass Vulnerability

An authentication bypass vulnerability has been identified in the Rising Technosoft CAP back office application, all versions prior to 2.0.4. This vulnerability arises from an improper implementation of the one-time password (OTP) verification mechanism in the application's API-based login. A remote attacker with valid credentials could exploit this issue by manipulating the API request URL or payload, effectively bypassing two-factor authentication (2FA) for other user accounts.

Impact

Exploitation of this vulnerability could lead to unauthorized bypassing of two-factor authentication, allowing attackers to access accounts of other users without proper verification.

Remediation

Users are advised to upgrade the Rising Technosoft CAP back office application to version 2.0.4 or later.