This vulnerability in ItzCrazyKns Vane (up to version 1.12.1) results from missing authentication checks in some unknown functionality of the API component's route.ts file. The flaw allows remote attackers to potentially bypass authentication mechanisms. The attack complexity is high, and no privileges or user interaction are required. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity. Although an exploit has been publicly disclosed, no official patch or fix has been released, and basic authentication is indicated as a planned mitigation.

The vulnerability allows remote attackers to bypass authentication in the affected API component, potentially leading to unauthorized access to functionality that should require authentication. The impact is limited by the high complexity of the attack and the low vector and impact metrics in the CVSS score. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Basic authentication is planned by the vendor as a mitigation measure. Until an official fix is released, users should monitor vendor communications for updates and consider implementing additional access controls or network-level protections to limit exposure.