CVE-2026-7671

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-307 CWE-799

Affected software

No affected versions have been published.

Timeline

Published: May 3, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-767107.5A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive inform CVE-2026-767117.5A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket c CVE-2026-767127.3A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial CVE-2026-767137.2A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vuln CVE-2026-767147.2Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underl CVE-2026-767157.1A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Su CVE-2026-767165.3Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An un CVE-2026-767175.3A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthe CVE-2026-767188.2A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.CVE-2026-767198.2A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions.CVE-2026-76726.3A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/mai CVE-2026-767204.3A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect.