This vulnerability (CWE-307) in BiHayat App version 2.1.7 arises from improper restriction of excessive authentication attempts, enabling an attacker to bypass authentication mechanisms. The flaw allows repeated authentication attempts without adequate rate limiting or lockout, facilitating unauthorized access. The vendor has not provided a response or fix, and no known exploits are reported in the wild as of now.

Successful exploitation can lead to full authentication bypass, granting attackers unauthorized access to user accounts or sensitive functions within the BiHayat App. The CVSS score of 9.4 reflects high confidentiality and integrity impact with low attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor. Until a fix is released, consider implementing external mitigations such as network-level rate limiting or multi-factor authentication if possible.