Vulnerability · Published Jul 21, 2025 · Assigned by cirosec
CVE-2025-41459Insecure authentication due to missing bruteforce protection and runtime manipulation in Two App Studio Journey 5.5.6 for iOS
High 7.8
In plain English
A high-severity improper authentication in Journey from Two App Studio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 91.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN attempts or dynamic code injection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Two App Studio | Journey | 0 – through 5.5.9 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cirosec.de/sa/sa-2025-006 third-party-advisory