AstronRPA versions up to 1.1.6 carry an authentication bypass flaw that allows an unauthenticated attacker to send any Bearer token to the OpenResty gateway. The gateway accepts the token without validation, enabling the attacker to reach protected API endpoints such as /api/resource/ and /api/rpa-ai-service/. By optionally manipulating X-User-Id or user_id headers, the attacker can impersonate any user, effectively gaining unauthorized access to sensitive data and functionality within the system. The weakness stems from improper authentication (CWE‑287).

The vulnerability affects iflytek AstronRPA deployments running version 1.1.6 or earlier. Systems that recently upgraded to 1.1.6 but have not applied further updates are still exposed. The problem resides in the OpenResty gateway component, specifically the auth_handler.lua script, which resides in the service container for the application.

The CVSS score of 6.9 indicates a medium severity level that escalates to dangerous if an attacker can reach the exposed API endpoints. The EPSS score is unavailable, so there is no quantified probability of exploitation, but the flaw was reported with active discussion of public exploits and a known vulnerability in the code base. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote network access over HTTP, where an unauthenticated attacker can supply arbitrary Bearer tokens to the endpoint. No additional system or credentials are required to exploit this weakness, making it readily actionable by an external threat actor.