The vulnerability originates from a missing authentication check in the resolveAuth function of the Webhook Verification Handler. This omission allows an attacker to submit requests to the webhook endpoint without providing valid credentials. As a result, unauthorized callers could trigger the handler's logic, potentially leading to unintended data exposure or manipulation. The flaw is classified as an authentication failure (CWE‑287) and missing authentication for a critical function (CWE‑306). Remote exploitation is feasible because the vulnerable code is exposed over a network interface.

Nextlevelbuilder GoClaw, version 3.11.3 and earlier, is affected. The vulnerability resides in the internal/http/auth.go component used by the webhook verification service.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is currently unavailable, but the lack of publicly available fix increases concern. The exploit can be performed remotely by sending crafted requests to the webhook endpoint, and because the vulnerability bypasses authentication, it may allow attackers to perform actions intended only for authorized users. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploitation activity is documented, though the issue has been disclosed on public channels.