Is CVE-2025-1928 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-1928 being exploited in the wild.

How severe is CVE-2025-1928?

Critical severity, with a CVSS score of 9.1, published 19 December 2025.

Which products and versions are affected?

Restajet Information Technologies Inc. Online Food Delivery System through 19122025.

Is there a fix for CVE-2025-1928?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-1928 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-1928?

Check whether you run Restajet Online Food Delivery System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-1928: Restajet Online Food Delivery System authentication bypass via brute force

CVE-2025-1928 · Severity: critical · CVSS 9.1 · Published 2025-12-19

The Restajet Online Food Delivery System, used by businesses to manage customer orders, contains a security flaw in its authentication process. This vulnerability allows an attacker to repeatedly attempt to guess passwords or recovery codes without being blocked. If exploited, an unauthorized person could take over customer or administrator accounts, potentially leading to the theft of personal data or disruption of business operations.

Technologies: Restajet Online Food Delivery System. Vendors: Restajet.

Quick answers

Is CVE-2025-1928 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-1928 being exploited in the wild.
How severe is CVE-2025-1928?: Critical severity, with a CVSS score of 9.1, published 19 December 2025.
Which products and versions are affected?: Restajet Information Technologies Inc. Online Food Delivery System through 19122025.
Is there a fix for CVE-2025-1928?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-1928 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-1928?: Check whether you run Restajet Online Food Delivery System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) exists in the Restajet Online Food Delivery System through version 19122025. The application fails to implement adequate rate limiting or account lockout mechanisms on authentication endpoints, specifically affecting the password recovery workflow. A remote, unauthenticated attacker can exploit this by brute-forcing recovery tokens or passwords over the network. Successful exploitation allows for full account takeover. As of the disclosure date, the vendor has not responded to notifications, and no official patch has been confirmed.

Affected products

Restajet Information Technologies Inc. Online Food Delivery System through 19122025

Timeline

2025-12-19: disclosed: Initial disclosure by TR-CERT (USOM)
2025-12-19: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.