CVE-2025-51054 describes an incorrect access control vulnerability in Vedo Suite 2024.17. The flaw allows remote attackers to bypass authentication and obtain a valid high privilege JSON Web Token (JWT) by sending an empty HTTP POST request to the /autologin/ API endpoint. This issue stems from improper validation of authentication requests, enabling privilege escalation without prior credentials. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity.

An attacker can remotely acquire a valid high privilege JWT token without any authentication, potentially allowing unauthorized access to sensitive or administrative functions within Vedo Suite 2024.17. The confidentiality and integrity of the system are impacted, but availability is not affected. This could lead to unauthorized data access or modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /autologin/ API endpoint where possible, implement network-level controls, and monitor for unusual authentication attempts targeting this endpoint.