The vulnerability in DTStack Taier, identified in the preHandle method of LoginInterceptor.java within the Source Connection Test Endpoint, allows an attacker to bypass authentication checks. By manipulating the request flow, an unauthorized user can authenticate as a legitimate user, granting access to protected resources and operations that require valid credentials. The flaw is classified as CWE‑287, indicating a broken authentication mechanism.

Affected products are DTStack's Taier component, all releases up to version 1.4.0. The vulnerability applies to installations that include the Source Connection Test Endpoint and use the legacy LoginInterceptor.java implementation prior to the patch. No specific patch version is listed beyond the commit that fixes the issue, so any deployment of Taier 1.4.0 or earlier is potentially vulnerable.

The CVSS score of 6.9 indicates a medium severity level. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting the exploitation risk is not currently observed at a large scale. However, the exploit is publicly disclosed and can be performed remotely, so the attack surface exists for any publicly accessible Taier deployment. An attacker who successfully exploits this flaw gains unauthorized access to sensitive data and actions, undermining confidentiality, integrity, and availability of the system. The risk is moderate but non‑negligible, warranting prompt remediation.