An improper authentication flaw resides in the /api/Cdn/GetFile endpoint of the linqi application. The ValidateAnonFileAccess function mistakenly permits file access when an 'AnonFile' query parameter of precisely 256 characters is supplied. This bypass lets unauthenticated, remote attackers retrieve requested files without needing valid credentials. The vulnerability only exposes minified JavaScript and CSS assets, which are already publicly reachable through the CDN and contain no confidential information. Therefore, the direct security impact is minimal, though the flaw demonstrates a weakness in the authentication logic.

The affected vendor is linqi GmbH, product linqi. No specific version information is disclosed in the advisory.

The CVSS score is 6.9, categorizing the vulnerability as medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Likely, the attack vector is remote, via HTTP requests to the /api/Cdn/GetFile endpoint. Attackers require no credentials or other prerequisites beyond the valid query parameter length. While the exploit is straightforward, the limited commercial value of the compromised resources reduces the overall risk to the organization.