Unsaflok Flaw Let Attackers Open Million of Doors in Seconds

Researchers disclosed a critical vulnerability called "Unsaflok" in Dormakaba Saflok hotel and multi-family electronic locks that enables attackers to clone/forge a master keycard (via weaknesses in MIFARE Classic keycards and a proprietary KDF) to unlock any door at affected sites; the issue affects over 3 million locks across ~13,000 properties worldwide, vendor remediation began in late 2023 but patched status cannot be determined visually and no confirmed real-world exploitation has been reported.