This vulnerability in zhistaredu StarTraining up to version 3.8.1 allows remote attackers to bypass authentication due to a missing authentication check in an unspecified function of the SecurityConfig.java file associated with the api-docs endpoint. The vulnerability is remotely exploitable without requiring privileges or user interaction. An exploit has been publicly released. The vendor has not responded to the disclosure and no patch or remediation information is currently available.

An attacker can remotely exploit this vulnerability to bypass authentication controls, potentially gaining unauthorized access to the affected system's api-docs endpoint. This could lead to unauthorized information disclosure or further attacks depending on the system's configuration and data exposure. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the ease of exploitation and the impact of missing authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates and consider restricting access to the api-docs endpoint or implementing additional access controls as a temporary mitigation.