This vulnerability affects the create_app function in the backend/app/__init__.py file of 666ghj MiroFish versions 0.1.0 through 0.1.2. The flaw results in missing authentication controls on a REST API endpoint, enabling remote unauthenticated attackers to perform unauthorized actions. The issue was responsibly disclosed to the project, but no response or patch has been provided. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to bypass authentication mechanisms on the affected REST API endpoint, potentially leading to unauthorized access or manipulation of the application. The published exploit increases the risk of exploitation, but no known active exploitation in the wild has been reported. The impact is rated medium based on CVSS 4.0 scoring.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates or patches. Until a fix is released, consider restricting network access to the affected API endpoints or implementing external authentication controls as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.