CVE-2026-90579 describes an authentication bypass vulnerability in Cheshire Cat AI versions up to 1.9.2. The flaw resides in the _authorize_http_key function within core/cat/factory/custom_auth_handler.py, where manipulation of the user_id parameter leads to missing authentication checks. This vulnerability can be exploited remotely without privileges or user interaction. The vulnerability is classified under CWE-287 (Improper Authentication). Although the issue was reported early to the project, no response or patch has been provided. The exploit has been publicly disclosed, but no known in-the-wild exploitation is confirmed.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication mechanisms, potentially leading to unauthorized access with limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. This could compromise system security by granting attacker access without proper credentials.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates and consider implementing additional access controls or network-level protections to mitigate exposure until a patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.