CVE-2025-29996 — Authentication Bypass Vulnerability in CAP back office application

CVE-2025-29996

Authentication Bypass Vulnerability in CAP back office application PUBLISHED

Description (CNA)

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.

Affected (CNA)

Vendor / product	Versions
Rising Technosoft / CAP back office application	affected <2.0.4

CWE

CWE-288

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.