DevGuard versions before 1.2.2 have a vulnerability where the SessionMiddleware trusts the X-Admin-Token HTTP header as the authenticated userID if no Kratos session cookie is present. This allows an unauthenticated attacker who knows or can guess a user's Kratos identity UUID to bypass authentication and act as that user. The impact is especially severe if the targeted user has administrative privileges within an organization, granting the attacker full control over that organization's resources. The vulnerability is identified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and has a CVSS 4.0 score of 9.3 (critical). The issue is resolved in DevGuard version 1.2.2.

An unauthenticated attacker can impersonate any user by supplying a guessed or known Kratos identity UUID in the X-Admin-Token header, bypassing normal authentication controls. If the impersonated user is an organization admin or owner, the attacker gains full administrative control over that organization's DevGuard resources, potentially leading to unauthorized access, modification, or disruption of vulnerability management processes.

Upgrade DevGuard to version 1.2.2 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, remediation depends on applying the official fix.