This vulnerability affects JeecgBoot 3.9.1 and arises from improper authentication handling in the OpenAPI Endpoint component, specifically related to processing requests at /openapi/call/. The flaw allows remote attackers to bypass authentication under certain conditions. The attack complexity is high, meaning exploitation requires significant effort or specific conditions. No privileges or user interaction are needed to attempt exploitation. The vendor has not issued any advisory or fix, and no patches are currently available.

Successful exploitation could allow an unauthenticated remote attacker to bypass authentication controls in JeecgBoot 3.9.1, potentially gaining unauthorized access to protected functionality exposed via the OpenAPI Endpoint. However, the high complexity and lack of known exploits reduce the immediate risk. The vulnerability does not require user interaction and affects confidentiality and integrity to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the /openapi/call/ endpoint through network controls or application-level filtering to reduce exposure.