The official description states that Drupal Commerce guest registration versions all contain a flaw that allows authentication bypass during the guest registration flow. The description is brief but identifies the affected versions as all releases (*.*). The presence of CWE‑287 confirms an authentication bypass, implying an attacker could create or elevate user accounts without valid credentials, potentially gaining unauthorized access to site resources.

The affected product is the Drupal Commerce guest registration module. All released versions, denoted as *.*, are impacted, and the module is currently unsupported. Any Drupal site that still includes this module and exposes its guest registration functionality to external users is at risk. Because no new version has been released, administrators have no official patch.

The CVSS score of 9.1 marks this flaw as high severity. The EPSS score of less than 1% indicates a low current likelihood of exploitation, yet attackers could still target exposed registration endpoints that require no authentication. Although the vulnerability is not yet listed in the CISA KEV catalog, the authentication bypass nature of the flaw means that exploitation is conceivable, especially against publicly reachable registration services. Based on the module’s public interface and the CWE classification, the likely attack vector is the registration endpoint reachable without prior authentication; this inference is drawn from the documented flaw and the nature of the component, not explicitly stated in the advisory.