Executive brief
KTM System e-BOK, a web portal used by housing cooperative members to manage personal data and billing, enforces extremely weak password requirements. The system limits passwords to a maximum of six numeric digits and prohibits the use of letters or special characters. This significantly increases the risk of unauthorized account access through automated guessing attacks, potentially exposing sensitive resident information and financial records.
Technical details
KTM System e-BOK contains a weak password requirement vulnerability (CWE-521). The application restricts user passwords to a maximum of six numeric digits (0-9) and explicitly forbids non-numeric characters. This creates a very small keyspace (1,000,000 possible combinations), which is highly susceptible to brute-force attacks. When combined with the lack of rate limiting (CVE-2026-35098), an attacker can rapidly iterate through all possible combinations to gain unauthorized access to user accounts. The issue was addressed in the June 2026 patch.
Affected products
- KTM System e-BOK All versions prior to June 2026 update
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory
- 2026-06-01: patched: Patched in June 2026 update