This vulnerability in inkeep agents 0.58.14 involves the createDevContext function within the runAuth middleware component. An attacker can manipulate this function remotely to bypass authentication by using an alternate channel. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The issue was reported early to the project but remains unaddressed, and exploit code is publicly available.

Successful exploitation allows remote attackers to bypass authentication controls, potentially granting unauthorized access to the affected system. This can undermine the security model of the inkeep agents, possibly leading to unauthorized actions or data exposure. The impact is rated medium based on the CVSS score and the described limited impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes have been published, users should monitor the vendor's communications for updates. Until a fix is released, consider restricting network access to the affected service or implementing additional external authentication controls if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.