A logic flaw in Metasploit Framework’s JSON‑RPC interface causes the authentication flag to be reset to false when a database health check fails and the environment variable MSF_WS_JSON_RPC_API_TOKEN is unset. The authentication strategy then interprets this false state as an indication that authentication is not required, which effectively bypasses access controls and grants local users the ability to issue arbitrary JSON‑RPC commands. This omission could allow a local attacker to execute privileged API calls, modify configurations, or compromise system integrity.

The vulnerability affects the Rapid7 Metasploit Framework; specific version information is not disclosed in the advisory, so any instance that permits local JSON‑RPC access and has not applied the patch may be impacted.

The CVSS score of 5.1 reflects moderate severity, and no EPSS score is provided. The issue is not listed in CISA’s KEV catalog. Exploitability is largely limited to local platforms where the JSON‑RPC service is available, no remote exploitation vector is described. The required preconditions include a database health check failure and the absence of the MSF_WS_JSON_RPC_API_TOKEN variable, conditions that could be intentionally triggered by a local attacker or occur naturally under certain failure conditions. The vulnerability is a fail‑open logic flaw (CWE‑305), which offers attackers a predictable bypass of authentication steps.