MFA Improper Limitation of a Record Access in Airship AI Acropolis

CVE-2025-35041

What is CVE-2025-35041?

The Airship AI Acropolis product is vulnerable due to a flaw in its multi-factor authentication (MFA) mechanism. Specifically, after a user successfully logs in with valid credentials, the system allows unlimited attempts to enter the MFA code for a 15-minute period. This vulnerability enables remote attackers who already possess valid user credentials to conduct brute-force attacks on the 6-digit MFA code, potentially compromising user accounts. The issue has been addressed in the versions 10.2.35, 11.0.21, and 11.1.9.

References