This vulnerability affects the AgentRuntime function in the AgentManager subsystem of SmythOS sre (up to version 0.0.15). Improper authentication arises from the ability to manipulate the HTTP header arguments X-DEBUG-RUN or X-DEBUG-INJ, allowing an attacker to bypass authentication controls remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vendor has not issued a patch or advisory, and the exploit code is publicly available.

Successful exploitation allows remote attackers to bypass authentication mechanisms in SmythOS sre, potentially granting unauthorized access to protected functionality. The impact on confidentiality, integrity, and availability is assessed as low to limited. There is no indication of widespread exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor for vendor advisories for any future fixes. Until a patch is released, consider implementing network-level controls to restrict access to the affected service and closely monitor for suspicious activity related to the X-DEBUG-RUN and X-DEBUG-INJ headers. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.