The vulnerability allows an attacker to create an administrator account without authentication. Sending crafted HTTP requests to the admin API triggers the flaw, giving the attacker full control over the platform and customer data. The weakness arises from improper authentication and privilege management as captured by CWE‑269 and CWE‑306.

Bluspark Global’s BLUVOYIX platform is affected. Any deployed instance lacking a recent patch is susceptible; the description does not specify version ranges, so all current releases should be reviewed for the fix.

With a CVSS score of 10 the flaw is classified as critical. Although the EPSS score is below 1 % suggesting low current exploitation likelihood, the remote nature and zero‑authentication requirement mean the risk of compromise remains high. The vulnerability is not yet listed in KEV, but organizations with BLUVOYIX exposed to the Internet should be treated as high‑risk targets. Attacks would proceed by sending unauthenticated HTTP requests from any external host.