Authentication bypass in Stela versions prior to 1.60.1 occurs because the application stores user identifiers and authentication status in a client‑controlled cookie named "authProcess" that is never validated for integrity. This represents a CWE-565 vulnerability. The cookie contains a userId and a validSteps flag that a remote attacker can modify without possessing credentials. By manipulating these values, the attacker can complete the login process and obtain an administrator‑level JSON Web Token, allowing impersonation of any account, including one with "SUPER_ADMIN" privileges. This directly compromises the confidentiality and integrity of the application.

Diaple Stela software running any version earlier than 1.60.1 is affected. Users should verify the installed version against the vendor’s list of vulnerable releases.

The vulnerability has a CVSS score of 9.3, reflecting a very high impact if exploited. The EPSS score is less than 1%, indicating that exploit activity is infrequently reported, and the issue is not listed in the CISA KEV catalog. Nonetheless, the attack can be launched remotely by crafting a malicious authProcess cookie without requiring any additional interaction or compromise, making it trivial for an attacker to impersonate privileged users.