high7.5
CVE-2025-35041
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials.
Impact
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Airship.Ai | Acropolis | before 10.2.35 from 11.0.0 before 11.0.21 from 11.1.0 before 11.1.9 |