The flaw resides in the appleLogin endpoint of CRMEB’s API. By manipulating the openId argument, an attacker can bypass authentication and obtain a valid session without legitimate credentials. This authentication bypass (CWE-287) enables remote attackers to impersonate any user, potentially accessing sensitive data and performing privileged actions. The vulnerability carries a CVSS score of 6.9, indicating moderate severity, and can be exploited over the network.

CRMEB products up to version 5.6.3 are affected. The vulnerable code is located in crmeb/app/api/controller/v1/LoginController.php. No other vendors or product lines are listed.

The EPSS score of less than 1% suggests low but non-zero likelihood of exploitation, yet the public release of exploit code increases the real‑world risk. The flaw is not currently catalogued in CISA’s KEV, but the lack of vendor response means an open window remains. Remote attackers with network access to the API endpoint can craft a malicious openId value and gain unauthorized access without any additional constraints noted in the description.