This vulnerability (CVE-2026-49197) involves improper authentication (CWE-287) in the Acer Predator Connect W6x device. The web endpoints intended for the Acer Connect app improperly handle the HTTP Authorization header by not blocking requests when Base64 decoding fails. This failure in validation can allow attackers to bypass authentication mechanisms, potentially gaining unauthorized access to the device or its services. The affected version is W6x_GBL_2.00.000005. The vulnerability has a CVSS 4.0 score of 10, reflecting its critical impact. No patch or official remediation is currently documented.

An attacker can exploit this vulnerability to bypass authentication controls on the affected Acer Predator Connect W6x device, potentially gaining unauthorized access to protected resources or administrative functions. Given the critical CVSS score of 10, the impact is severe, allowing full compromise without requiring privileges or user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict network access to the affected device's management interfaces to trusted networks only and monitor for suspicious activity. Avoid exposing the device to untrusted networks. Follow up with Acer for updates on patches or mitigations.