CVE-2026-6853: OTP Bypass in Başbelen Group's Pause+ Mobile App

Synopsis

An authentication bypass vulnerability exists in the Pause+ Mobile App by Başbelen Group, caused by improper restriction of excessive authentication attempts on the OTP (one-time password) login flow. The flaw is reachable over the network with no authentication and no user interaction required, meaning any remote attacker can reach it directly. Successful exploitation allows an attacker to bypass the OTP check entirely, gaining full unauthorized access with high impact to confidentiality, integrity, and availability. A patched-image rebuild at v1.5 is available on HarborGuard for environments running an affected version between v1.0.6 and v1.5.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Pause+ Mobile App's authentication endpoint over the network; no physical or local access is needed.

• AuthenticationNot required

  No credentials or existing session are required; the attacker can interact with the OTP endpoint as an unauthenticated party.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed for the attacker to exploit this vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• An attacker bypasses OTP authentication and gains full access to user accounts without knowing valid one-time passwords.
• Account contents including stored personal data, order history, and session tokens become readable to the attacker.
• An attacker can modify account details, place orders, or alter persisted records within the affected user's profile.
• The authentication service itself is subject to disruption through uncontrolled repeated request flooding, which the missing rate-limit controls allow.