Network‑AI versions 5.14.0 through 5.15.4 contain a missing authentication issue in the A2AServer component. The flaw allows an attacker who can reach the JSON‑RPC endpoints to perform task operations—submission, retrieval, and cancellation—without providing a Bearer token or any other form of credential. Because the vulnerability is a straight lack of authentication, an adversary who can access the network interface can cause arbitrary task execution, read arbitrary results, or terminate tasks, all of which can disrupt service availability or leak data. The weakness is classified as "Missing Authentication" (CWE‑306).

The affected product is Jovancoding’s Network‑AI application, specifically versions 5.14.0 through 5.15.4 inclusive. No other vendors or products are listed, and the known CPE points to the same Network‑AI implementation. Administrators should verify whether these versions are deployed and whether a secret is configured for the A2AServer. If the dependency default or configuration omits a secret, the vulnerability is present; configuring a secret restores proper authentication.

The CVSS base score is 6.9, indicating a moderate severity that can be leveraged by an attacker who can reach the service. The EPSS score is not available, so it is unclear how frequently attacks are observed, but the lack of authentication suggests a high likelihood of exploitation in environments where the service is exposed to untrusted networks. The vulnerability is not currently listed in the CISA KEV catalog, meaning no known public exploit is documented. Attackers can forge JSON‑RPC messages to endpoints such as tasks/send, tasks/get, and tasks/cancel without any token, implying the attack vector is network‑based and straightforward for anyone who can communicate with the A2AServer.