This vulnerability affects the badlogic pi-mono product, specifically the Slack Bot component in the file packages/mom/src/slack.ts. An attacker can manipulate processing in this component to bypass authentication by using an alternate communication channel. The issue impacts versions 0.58.0 through 0.58.4. The vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor has not provided a patch or remediation, and the exploit is publicly known.

Successful exploitation allows an attacker to bypass authentication controls remotely, potentially gaining unauthorized access to the affected system or component. This could lead to unauthorized actions or access within the pi-mono environment. The vulnerability does not require user interaction and can be exploited with low privileges, increasing the risk of compromise. However, the impact is limited to the affected component and does not indicate system-wide compromise or data confidentiality loss based on available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should monitor for updates from badlogic. Until a fix is released, consider restricting network access to the affected component or implementing compensating controls to limit exposure to remote attacks targeting the Slack Bot functionality.