Sonatype Nexus Repository 3 contains a vulnerability where it does not require realm administration permission when a user creates a Rut Auth capability. This allows a user with only the capability creation permission to enable header-based authentication, enabling remote clients to authenticate as any existing user, including administrators, without credentials.