Philipp Brügger

**Name of the Vulnerable Software and Affected Versions** Akia keyless entry cloud service (affected versions not specified) **Description** An Insecure Direct Object Reference (IDOR) exists due to missing object-level authorization. The unlock action relies on a client-supplied room or door identifier that the server does not properly validate against the authenticated guest's booking. This allows an authenticated guest to remotely trigger the unlocking of rooms other than their own, granting unauthorized physical access to guest rooms at an affected property. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.