This vulnerability in the OUSL-GROUP-BrinaryBrains School Student Management System up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6 affects the sign_auth_cookie function within the MY_Controller component. By manipulating the role argument, an attacker can bypass proper authentication mechanisms remotely. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with an available exploit, but no patch or official remediation has been published. The rolling release model complicates version tracking for fixes. The vendor has not yet responded to the issue report.

Successful exploitation allows remote attackers to bypass authentication controls by manipulating the role argument in the sign_auth_cookie function. This could enable unauthorized access to the system, potentially compromising user accounts or sensitive student management data. The impact is rated medium severity based on CVSS 6.9, reflecting moderate risk due to ease of exploitation and potential access gained. There is no indication of privilege escalation or denial of service in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded or released an official fix. Until a patch is available, organizations should consider restricting access to the affected system, monitoring for suspicious authentication activity, and applying compensating controls to limit exposure. Avoid relying solely on the vulnerable authentication mechanism. Follow vendor updates closely for any forthcoming fixes.