Kaleris YMS Authentication Bypass Vulnerability in Login Mechanism

An authentication bypass vulnerability has been identified in Kaleris YMS version 7.2.2.1. This issue allows attackers to bypass login verification for the Driver User Role, enabling unauthorized access to the application's resources. The vulnerability arises from the login mechanism, which fails to properly validate authentication for drivers using different login URLs that require unique credentials. As a result, a driver can exploit this flaw to access functionalities associated with the other URL without proper authorization.

Impact

Exploitation of this vulnerability allows for unauthorized access to application resources and functionalities associated with the Driver User Role.

Reproduction

To reproduce this vulnerability, log into the YMS Truck Display URL as a driver. Once logged in, open a new tab in the same browser session and access the general home URL. The dashboard will be accessible without re-entering credentials, demonstrating the authentication bypass.