This vulnerability permits an unauthenticated attacker to inject arbitrary query conditions into the JPOM-USER‑TOKEN HTTP header. The injected string is parsed by Hutool’s Condition parser as an operator, which can then be exploited to execute commands via Jpom’s script features. The result is a full super‑administrator privilege set, potentially allowing any malicious action within the application.

The flaw is present in Jpom version 2.10.0 through 2.11.12. All instances of this product, regardless of deployment size or configuration, are affected.

With a CVSS score of 9.3 this vulnerability is considered critical. The EPSS score is not available, and the lack of a KEV listing does not diminish the risk. The attack vector is clear: a remote attacker can send a crafted HTTP request with a special header value such as "is not null" to bypass authentication and gain administrative control, all without needing any prior credentials.