CVE-2021-42949

CVE-2021-42949 is a critical authentication bypass vulnerability affecting HotelDruid Hotel Management Software v3.0.3. It stems from the controlla_login function generating predictable session tokens, enabling attackers to bypass authentication through brute-force attacks. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating it can be exploited remotely with low complexity, requiring no user interaction, and leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers.