A missing authentication vulnerability exists in an unknown function of the API Command Endpoint in the hexstrike_server.py file of 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04. This flaw allows remote attackers to initiate actions without authentication. The product employs continuous delivery with rolling releases, and no explicit affected or fixed versions have been provided. The issue was reported early to the project, but no response or remediation has been issued. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) and has been publicly disclosed. There is no evidence of exploitation in the wild.

The vulnerability enables remote attackers to bypass authentication on the API Command Endpoint, potentially allowing unauthorized access or control of the affected system. The lack of authentication could lead to unauthorized commands being executed remotely. However, the impact is rated medium severity based on CVSS 4.0 scoring, indicating limited or partial impact. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The project has not responded or issued a fix as of the latest information. Users should monitor official channels for updates and consider restricting network access to the API endpoint as a temporary measure until a fix is available.