CVE-2026-15586
MediumCVSS 5.3Summary
Ontime improperly restricts excessive authentication attempts, enabling brute force attacks. The issue affects versions through 2026-10-27; the vendor did not respond to the disclosure.
Risk Assessment
Lack of login attempt limits lets an attacker guess passwords and potentially take over accounts. This may lead to unauthorized system access.
Recommendation
Implement login attempt throttling, account lockout, and strong password policies. Consider additional controls such as MFA until a fix is available.
Other vulnerabilities in Ontime
See all- CVE-2026-5799High
An authorization bypass vulnerability in Ontime through a user-controlled key allows exploitation of trusted identifiers. Affects versions up to 04052026.
- CVE-2026-5730High
An authorization bypass vulnerability in Ontime allows exploitation of trusted identifiers through a user-controlled key. The issue affects versions up to 04052026.
Original NVD description (English source)
Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Services Inc. Ontime allows Brute Force. This issue affects Ontime: through 2026-10-27. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS