This vulnerability (CVE-2026-54833) in Enable CORS (<= 2.0.3) is classified under CWE-321 for the use of a hard-coded cryptographic key, which introduces an unauthenticated backdoor. The CVSS 3.1 score is 7.4 (high), with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity. The vulnerability allows attackers to bypass authentication mechanisms by exploiting the hard-coded key, potentially leading to unauthorized access and control. No vendor advisory or patch information is currently provided.

The vulnerability allows unauthenticated attackers to exploit a backdoor in Enable CORS, compromising confidentiality and integrity of the affected system. This can lead to unauthorized access and manipulation of data or functionality within the affected product. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected service and monitoring for suspicious activity related to Enable CORS. Avoid using affected versions in production environments if possible.