Bitcoin Core contains an undisclosed authorization control vulnerability first appearing in release 0.14 and persisting through the 28.x series. The flaw is classified as CWE‑284, indicating a lack of proper authorization checks; as a result, an attacker could potentially perform actions or modify configuration that should be restricted, thereby jeopardizing confidentiality, integrity, or availability of a node. The vendor has not released further details, so the exact capabilities remain unknown.

All Bitcoin Core nodes from version 0.14 up to the current 28.x series are affected. This includes operators of full nodes, light clients that rely on the core back‑end, and any service built on top of Bitcoin Core without a patch. Users on these versions should treat their installations as vulnerable until an official fix is released.

The CVSS score of 7.5 indicates a high‑impact vulnerability; the EPSS score suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalogue. The CVE description does not disclose the precise exploitation mechanism, so any potential attack path remains uncertain.