PT-2025-34054 · Unknown · Touch Lebanon Mobile App

Ksarieddine · Published 2025-08-20 · Updated 2025-08-20 · CVE-2025-50503

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Touch Lebanon Mobile App version 2.20.2

Description: A flaw exists in the password reset workflow that allows an attacker to bypass the one-time password (OTP) reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without a legitimate authentication factor, such as an OTP. This compromises account security and allows for potential unauthorized access to user data.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-50503

Affected Products

Touch Lebanon Mobile App

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-50503 · Security Note
• https://twitter.com/CVEnew/status/1958180759279419595 · Twitter Post
• https://t.me/CVEtracker/30472 · Telegram Post
• https://github.com/ksarieddine/disclosures/blob/main/Touch%20Mobile%20Application/2FA%20Bypass%20-%20Touch%20Lebanon.md · Note
• https://touch.com.lb/autoforms/portal/touch/personal/contentandapps/mobileapp · Note