CVE-2026-92625

Control iD iDSecure, an access-control management server, exposes the /api/license/restartService endpoint without requiring authentication in versions prior to 4.8.3.0 (CWE-306, missing authentication for a critical function). When called, this endpoint runs an internal routine that terminates the iDSecure service process and relaunches it via a generated batch script. An unauthenticated remote attacker can invoke the endpoint repeatedly to trap the service in a continuous restart cycle, leaving the server unavailable and disrupting access-control management. Any organization running iDSecure before 4.8.3.0 is affected, with risk highest where the server's API is reachable from untrusted networks rather than only the local LAN. No public proof-of-concept is known, the flaw is not listed in CISA KEV, and no exploitation has been reported to date.

What to do: Upgrade iDSecure to version 4.8.3.0 or later, which restores authentication on the restartService endpoint. Until patched, restrict network access to the iDSecure server so /api/license/* is reachable only from trusted management hosts, and check firewall/proxy logs for repeated unauthenticated requests to /api/license/restartService, which would indicate restart-loop attempts.