The flaw allows an attacker to manipulate the security_key argument passed to the get_authentication_dependency function in auth.py, resulting in the denial of proper authentication checks. As a result, a remote attacker can authenticate as any user or gain unrestricted access to protected resources, as the vulnerability can be exploited over the network. This represents a classic authentication bypass validated by the CWE‑287 and CWE‑306 classifications.

Agno-agi Agno versions up to 2.7.3 and 3.0.6 are affected. The project is identified by the CNA vendor agno-agi and product agno. No patch or fix version is provided by the vendor in the available data, leaving the vulnerability present in these releases.

The CVSS base score is 6.9, indicating a moderate risk level. No EPSS score is available, but the exploit is publicly available and the vulnerability can be projected as a viable attack vector. The issue is not listed in the CISA KEV catalog, yet the remote exploitation potential warrants attention to access controls and the availability of a patch.