An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a passwordCustom option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative user.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Idsecure | Controlid | 4.7.32.0 (including) | 4.7.32.0 (including) |