The vulnerability in SPIP allows an unauthenticated attacker to bypass the authentication mechanism by exploiting PHP type juggling in the login logic. Attackers can achieve this by manipulating input values that trigger loose type comparisons, thereby gaining access to protected information. The weakness, CWE-288, reflects improper handling of authentication or access control, potentially leading to confidentiality loss of sensitive internal data.

SPIP products with versions earlier than 4.4.10 are affected. The vendor identified is SPIP, and the product name is SPIP. No specific patch release is listed, but the vulnerability exists on all instances running a pre‑4.4.10 build.

This flaw carries a high CVSS score of 8.7, indicating significant impact if exploited. The EPSS score of less than 1% suggests currently low exploitation probability, and it has not been listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web application interaction where an attacker attempts to log in using crafted input. No additional exploitation conditions are specified beyond the ability to send the manipulating request, so the vulnerability is exploitable in standard operational environments.