Universal Software FlexCity/Kiosk up to 1.0.35 authentication bypass

Summaryinfo

A vulnerability classified as critical was found in Universal Software FlexCity and Kiosk up to 1.0.35. This vulnerability affects unknown code. Executing a manipulation can lead to authentication bypass. This vulnerability appears as CVE-2026-1618. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in Universal Software FlexCity and Kiosk up to 1.0.35. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a authentication bypass vulnerability. The CWE definition for the vulnerability is CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Authentication Bypass Using an Alternate Path or Channel vulnerability in Universal Software Inc. FlexCity/Kiosk allows Privilege Escalation.This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.

The weakness was presented by İbrahim YİĞİtsoy. The advisory is available at usom.gov.tr. This vulnerability was named CVE-2026-1618 since 01/29/2026. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 1.0.36 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Universal Software

Name

• FlexCity
• Kiosk

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27
• 1.0.28
• 1.0.29
• 1.0.30
• 1.0.31
• 1.0.32
• 1.0.33
• 1.0.34
• 1.0.35

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion