This vulnerability (CVE-2025-1928) involves improper restriction of excessive authentication attempts (CWE-307) in the Online Food Delivery System by Restajet Information Technologies Inc. It enables attackers to repeatedly attempt password recovery operations, potentially leading to unauthorized access. The issue affects all versions through 19122025. The vendor has not issued any response or patch. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.

Successful exploitation could allow an attacker to bypass authentication controls by abusing unlimited password recovery attempts, leading to compromise of user accounts and unauthorized access to sensitive information. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations should monitor for updates from Restajet Information Technologies Inc. and consider implementing compensating controls such as rate limiting password recovery attempts or additional multi-factor authentication if possible.