The vulnerability exists in the Admin Login component of code-projects Hotel and Tourism Reservation System 1.0. Specifically, the password_verify function in /admin/login.php improperly handles the password argument, enabling attackers to bypass authentication remotely. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to bypass authentication controls in the admin login interface, potentially granting unauthorized administrative access. This could lead to unauthorized management of the reservation system, data exposure, or manipulation. However, the impact is rated medium due to limited scope and no confirmed active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the admin login interface by IP filtering or network segmentation to reduce exposure. Monitor for updates from the vendor or security advisories regarding patches or mitigations.