The vulnerability CVE-2026-15542 affects will-moss Isaiah versions 1.36.0 to 1.36.9 due to improper authentication in the Websocket Connection Authentication component (app/main.go). This flaw allows remote attackers to initiate attacks that bypass authentication controls. Although a pull request containing a fix has been submitted, it has not yet been merged or officially released. No known exploits are reported in the wild, and no official patch or remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to bypass authentication controls in the Websocket Connection Authentication component, potentially gaining unauthorized access to the application. The impact is rated medium with a CVSS 4.0 score of 6.9, indicating a significant but not critical risk.

A fix for this vulnerability has been developed and submitted as a pull request but is not yet officially released or accepted. Until the fix is merged and distributed, no official remediation is available. Users should monitor the vendor's repository or advisory channels for the acceptance of the fix and apply it promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.