Rclone versions from 1.64.0 up to but not including 1.75.2 have an authentication bypass vulnerability in the serve webdav feature. This flaw allows unauthenticated attackers to bypass authentication by sending OPTIONS HTTP requests. Exploitation enables attackers to probe arbitrary paths and use the Allow header values to determine the existence of files or collections, effectively allowing namespace enumeration.