The documented flaw in the Drupal Commerce guest registration module allows an attacker to bypass normal authentication checks during the guest registration flow. The official description states that the module contains a flaw that "allows …", although the full details are omitted. The presence of CWE-287 indicates that the vulnerability is an authentication bypass, suggesting that an attacker could create or elevate user accounts without providing valid credentials, potentially gaining unauthorized access to site resources.

The affected product is the Drupal Commerce guest registration module. All released versions, denoted as *.*, are impacted, and the module is currently unsupported. Any Drupal site that still includes this module and exposes its guest registration functionality to external users is at risk. Because no new version has been released, administrators have no official patch.

The CVSS score of 9.1 marks this flaw as high severity. The EPSS score of less than 1% indicates a low current likelihood of exploitation, yet attackers could still target exposed registration endpoints that require no authentication. Although the vulnerability is not yet listed in the CISA KEV catalog, the authentication bypass nature of the flaw means that exploitation is conceivable, especially against publicly reachable registration services. Based on the module’s public interface and the CWE classification, the likely attack vector is the registration endpoint reachable without prior authentication; this inference is drawn from the documented flaw and the nature of the component, not explicitly stated in the advisory.