The vulnerability lies in the sign_auth_cookie function of the Login controller, where an attacker can alter the role argument to bypass authentication. This flaw allows unauthorized users to gain access to protected resources and has been identified as CWE-287, an authentication bypass weakness. During exploitation the attacker crafts a request that changes the role parameter used in the authentication cookie, causing the system to treat the request as fully authenticated. The impact includes unauthorized reading, modification, or deletion of student records and potentially higher privileges if administrative roles are granted.

The affected product is the School Student Management System developed by OUSL-GROUP-BrinaryBrains. The issue affects all versions up to the commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Because the project follows a rolling-releases model, specific version numbers are not published, so any deployment built before the commit is potentially vulnerable.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack can be carried out remotely from the internet, and public proof-of-concept exploits have been released. An attacker can manipulate the role parameter in a request to the sign_auth_cookie method, bypassing authentication checks and gaining unauthorized access.