Threats affecting pkg:github/markmhendrickson/neotoma

Neotoma versions from 0.6.0 up to but not including 0.11.1 have an authentication bypass vulnerability. The application can mistakenly treat public reverse-proxied requests received over a loopback socket without a Bearer token as local requests. This causes the REST authentication middleware to resolve unauthenticated requests as the local development user, exposing the Inspector and related API without requiring credentials. This issue is fixed in version 0.11.1.