This vulnerability in AhaChat Messenger Marketing (versions <= 1.1) involves an authentication bypass via an alternate path or channel related to password recovery functionality. It allows an attacker to circumvent normal authentication controls, impacting the integrity and availability of the affected system. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, but limited integrity and availability impacts.

Successful exploitation could allow an unauthenticated attacker to bypass authentication controls by exploiting the password recovery process, potentially leading to unauthorized actions that affect system integrity and availability. Confidentiality is not impacted according to the CVSS vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patches or fixes have been referenced in the available data. Until a patch is available, closely monitor vendor communications for updates. Avoid relying solely on the password recovery mechanism for critical authentication security.