This vulnerability affects badlogic pi-mono up to version 0.58.4, allowing an attacker to bypass authentication by manipulating an alternate communication channel in the pi-mom Slack Bot component. The issue is located in the processing of the file packages/mom/src/slack.ts. The attack can be performed remotely without user interaction and requires low privileges. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not issued any patch or advisory, and the exploit is publicly known.

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms in the pi-mom Slack Bot component remotely. This could lead to unauthorized access to functionalities or data protected by authentication within the affected application. The medium severity score reflects limited but significant impact due to authentication bypass without requiring user interaction or high privileges.

No official patch or remediation is currently available from the vendor, as they have not responded to the disclosure. Users should monitor the vendor's channels for any future updates. Until a fix is released, consider restricting network access to the affected component or disabling the pi-mom Slack Bot functionality if feasible to reduce exposure.