This vulnerability affects the SmythOS sre product up to version 0.0.15 in the AgentRuntime function within the AgentManager subsystem's HTTP Header Handler. Improper authentication arises from manipulation of the HTTP headers X-DEBUG-RUN and X-DEBUG-INJ, allowing an unauthenticated remote attacker to bypass authentication controls. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vendor has not issued any patch or advisory, and no known exploits are currently active in the wild.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication mechanisms in SmythOS sre, potentially gaining unauthorized access to functionality protected by authentication. The impact on confidentiality, integrity, and availability is rated as low to limited. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's channels for any future updates or patches. Until a fix is provided, consider restricting access to the affected component or implementing additional network-level controls to limit exposure to untrusted networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.