The vulnerability is a flaw of type CWE‑287, improper authentication, located in the WebSocket Connection Authentication component of will‑moss Isaiah. When an attacker supplies crafted input to the app/main.go handler, the system fails to properly validate credentials, allowing the attacker to assume the identity of an authorized user. This grants the attacker whatever privileges the authenticated user possesses and can be executed remotely.

will‑moss Isaiah versions up to 1.36.9 are affected by this vulnerability. The issue has been identified in releases through the 1.36.9 milestone, but based on the description, it is inferred that none of the subsequent releases have applied the patch yet.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1 % suggests that, at present, the probability of active exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, implying no widely documented exploits. Attackers can initiate the exploit remotely against the WebSocket endpoint, but until the pending pull request is merged and a new version released, the risk remains moderate and could rise if a solution is delayed.