This vulnerability affects will-moss Isaiah versions 1.36.0 through 1.36.9. It arises from improper authentication handling in the Websocket Connection Authentication component, located in app/main.go. The flaw allows remote attackers to initiate attacks that bypass authentication controls. Although a pull request to fix the issue exists, it has not yet been merged or officially released, leaving the vulnerability unpatched at this time. The CVSS 4.0 base score is 6.9, indicating a medium severity level with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

The vulnerability enables remote attackers to bypass authentication in the affected versions of will-moss Isaiah, potentially allowing unauthorized access to the system or its functions. The impact is rated medium severity based on CVSS 4.0 scoring, reflecting limited but meaningful compromise potential. There are no known exploits in the wild at this time.

No official fix or patch is currently available as the pull request to address the issue awaits acceptance. Users should monitor the vendor's repository or advisory channels for the official patch release. Until then, consider restricting access to the Websocket Connection Authentication interface or applying compensating controls to limit exposure.