This vulnerability allows an attacker to bypass authentication controls on the Smart Parking System’s admin endpoints. By manipulating an unknown function within the admin component, an attacker can gain unauthorized administrative access without credentials. The flaw is classified as CWE‑287 (Authentication Bypass) and CWE‑306 (Missing Authentication for Sensitive Action), indicating that both the authentication mechanism and its enforcement are compromised.

The affected product is code‑projects Smart Parking System version 1.0. Multiple admin endpoints are vulnerable, and the issue is specific to an undocumented function in the admin component. Only this version is currently known to be impacted.

The CVSS score of 6.9 reflects moderate severity, and no EPSS data is available to quantify exploitation likelihood. Because the vulnerability can be triggered remotely and is publicly disclosed, users of the 1.0 release should treat it as a legitimate risk. The CVE is not listed in CISA’s KEV catalog, but the absence of an EPSS score does not indicate low risk in practice. Formal exploitation requires the attacker to target the exposed admin endpoints, which are typically accessible via the public network, making the vulnerability exploitable from outside the organization.