This vulnerability, identified as CWE-288, involves broken authentication in the Dimitri Grassi Salon booking system versions up to 10.30.26. It enables unauthenticated attackers to bypass authentication controls by leveraging an alternate path or channel, potentially granting full access to the system. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is published and reserved under CVE-2026-66453 but lacks vendor remediation or patch information.

Successful exploitation of this vulnerability could allow attackers to fully compromise the affected Salon booking system, leading to unauthorized access to sensitive data, modification or deletion of data, and disruption of service. The critical CVSS score indicates a severe risk to system security and business operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing compensating controls such as network segmentation, strict access controls, and monitoring for unusual access patterns specific to this product. Avoid exposing the affected versions to untrusted networks if possible.