This vulnerability in Omega Solution CoinEx Crypto 2025 involves an authorization bypass caused by manipulation of the ID argument in the /customer-currency/ endpoint of the Customer Information API. The flaw allows an attacker with low privileges to bypass authorization controls remotely without user interaction. Public exploit code is available, but no vendor response or patch has been provided. The product appears to be discontinued or replaced, as indicated by the absence of an active website.

An attacker can remotely bypass authorization controls in the affected API component, potentially gaining unauthorized access to customer currency information. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating a moderate risk. No evidence of active exploitation in the wild is reported.

No official patch or remediation is available due to lack of vendor response and apparent product discontinuation. Users should consider discontinuing use of the affected product or implementing compensating controls such as restricting access to the vulnerable API endpoint. Monitor for any updates from the vendor or community advisories.