A vulnerability in the jt808-server Web Management API's WebMvcConfig.addInterceptors method removes required authentication, allowing an attacker to invoke API endpoints without credentials. This omission can lead to unauthorized manipulation or inspection of server configuration via HTTP requests. The vulnerability is identified as CWE‑287 (Improper Authentication) and CWE‑306 (Missing Authentication), indicating that the server fails to enforce proper credential checking.

All versions of yezhihao jt808-server prior to commit a07f68c466b560b97ef41edb8a4966469abdf83e are affected. Because the product follows a rolling release model, any newer builds in the pipeline may also contain the flaw until the vendor releases a fix. There is no specific version numbering available for updated releases, so any current deployment should be considered potentially vulnerable.

The CVSS score of 6.9 indicates moderate severity, and the publicly available exploit suggests that an attacker can launch the attack remotely over the network without any special local privileges. The EPSS score is not available, so the precise likelihood of exploitation cannot be quantified, but the presence of an exploit and the lack of authentication checks raise significant risk. The vulnerability is not listed in CISA KEV, yet the remote nature and missing auth provide a straightforward path to administrative access, making it a high priority to patch or mitigate.