Onur Bi̇li̇ci̇

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** E-Commerce Website versions prior to 4.5.001 **Description** An authorization bypass exists due to a user-controlled key, which allows for session hijacking. This is an Insecure Direct Object Reference (IDOR), a condition where an application provides direct access to objects based on user-supplied input. **Recommendations** Update to version 4.5.001 or later.