CVE-2026-67594 describes a missing authentication vulnerability in the Spikster product by yolanmees. The root cause is that the CipiAuth middleware, intended to protect API routes, is registered but never actually applied to any routes in the API routing configuration. This flaw enables unauthenticated remote attackers to invoke about 50 API endpoints without restriction. These endpoints allow attackers to perform sensitive actions including enumerating and provisioning servers, resetting root passwords, reading and writing arbitrary files on the host system, and creating database users. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges required, and no user interaction needed.

The vulnerability allows unauthenticated remote attackers full access to critical API functions in Spikster. Attackers can enumerate and provision servers, reset root passwords, manipulate files arbitrarily on the host, and create database users. This leads to complete compromise of the affected system and potentially its underlying infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, restrict network access to the API endpoints to trusted users only and monitor for suspicious activity. Applying proper authentication middleware to all API routes is essential once a fix is released.