This vulnerability affects the rowboat product by rowboatlabs, specifically versions up to 0.1.67. The issue lies in the tools_webhook component, in the tool_call function of apps/experimental/tools_webhook/app.py, where improper authentication occurs when the X-Tools-JWE argument is manipulated. The vulnerability allows remote attackers to bypass authentication mechanisms. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low attack complexity, no privileges or user interaction required, and low impacts on confidentiality, integrity, and availability. The vendor has not issued any patch or official remediation.

Successful exploitation of this vulnerability allows remote attackers to bypass authentication controls in the affected component, potentially granting unauthorized access to functionality protected by the tool_call function. The impact is rated medium severity based on CVSS 4.0 scoring, reflecting limited but meaningful compromise potential. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded to disclosure and no fixes have been published, users should consider implementing compensating controls such as restricting access to the affected component, monitoring for suspicious use of the X-Tools-JWE argument, or disabling the vulnerable functionality if feasible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.