CVE-2020-10876

7.5 highEPSS 1.1%

High (7.5) in oklok project oklok. EPSS 1.1% chance of exploitation in the next 30 days.

The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification code that is required for resetting passwords, nor does it properly restrict excessive verification attempts. This allows an attacker to brute force the four-digit verification code in order to bypass email verification and change the password of a victim account.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWEs: CWE-307, CWE-613
Published: 2020-05-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oklok_project:oklok

References

https://apps.apple.com/us/app/oklok/id1392287771
https://github.com/fierceoj/ownklok
https://apps.apple.com/us/app/oklok/id1392287771
https://github.com/fierceoj/ownklok

Check your stack JSON