CVE-2026-66677: CWE-288 Authentication Bypass Using an Alternate Path or Channel in VaultDweller Leyka

This vulnerability, identified as CWE-288, concerns broken authentication in Leyka versions up to 3.32.3. It allows an attacker with low privileges to bypass authentication mechanisms by exploiting an alternate path or channel. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no user interaction, resulting in high confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation could lead to unauthorized access to the affected system, compromising confidentiality significantly, with some impact on integrity and availability. The attacker requires low privileges and no user interaction is needed, making it a serious risk for affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict access to affected versions and monitor for suspicious activity related to authentication bypass attempts.