Is CVE-2020-8791 actively exploited?

No active exploitation of CVE-2020-8791 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-8791 be exploited remotely?

Yes. CVE-2020-8791 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-8791?

CVE-2020-8791 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2020-8791

MEDIUM

CVE-2020-8791

CWE-639Published: May 4, 2020· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs.

NVD Source

Technical Analysis

CVE-2020-8791 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.