This vulnerability exists in the sign_auth_cookie function of the MY_Controller component within the Login.php file of the OUSL-GROUP-BrinaryBrains School Student Management System. An attacker can remotely manipulate the 'role' parameter to bypass authentication controls, leading to improper authentication. The product uses rolling releases, so specific affected or fixed versions are not identified. The issue was reported early to the project, but no official fix or response has been published. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to bypass authentication mechanisms remotely by manipulating the 'role' argument, potentially granting unauthorized access to the system. This could lead to unauthorized actions within the School Student Management System. However, the impact is rated medium, reflecting limited but significant risk. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixed versions are published, users should monitor the vendor's channels for updates. In the meantime, restricting access to the affected system and implementing additional authentication controls externally may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.