This vulnerability (CVE-2026-39450) in Aman FunnelKit Automations (<= 3.7.3) is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel. It allows an attacker with limited privileges to bypass subscriber authentication mechanisms, potentially enabling unauthorized actions that affect data integrity and system availability. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. No patch or official remediation level has been disclosed by the vendor or authoritative sources as of the publication date.

The vulnerability allows an attacker to bypass subscriber authentication, which can lead to unauthorized modification or disruption of the affected system's operations. While confidentiality is not impacted, the integrity of data and availability of the system can be significantly affected. This could result in service disruption or unauthorized changes within FunnelKit Automations environments running vulnerable versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No vendor-provided mitigation or temporary fix is currently available.