Webreaper Damselfly up to and including version 4.5.3 contains a critical authentication bypass flaw. The REST API controllers that manage user accounts have their authorization attributes commented out, allowing any party to call any /api/* endpoint without credentials. An attacker can issue a PUT /api/users request with an Admin role payload to create a new administrator account, or a POST /api/users to reset the password of any existing user, thereby achieving complete system control.

The vulnerability affects the Webreaper Damselfly application from the first release through 4.5.3. Users running any of these releases, including 4.5.3, are susceptible. No specific operating system or infrastructure constraints are indicated; the flaw resides in the application code itself.

The flaw is scored CVSS 9.3, indicating high exploitability and impact. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the absence of authentication enables remote attackers to execute privileged operations without restriction. The likely attack vector is remote over public network access to the application's API endpoints, and requires no special privileges or advanced exploits beyond sending crafted HTTP requests.