The weakness lies in the preHandle method of LoginInterceptor.java in GoogTech sms-ssm, allowing an attacker to bypass proper authorization checks. This flaw corresponds to the common weaknesses of improper privilege management and incorrect authentication, and lets a remote actor gain unauthorized access to protected API endpoints. The attacker can read, modify, or delete data that should be restricted, compromising confidentiality and integrity of the system.

Affected is the GoogTech sms-ssm API interface component. All releases up to commit e8534c766fd13f5f94c01dab475d75f286918a8d are vulnerable. The product uses a rolling release model, so the exact version is not disclosed; the fix will appear in future releases.

CVSS score 5.3 indicates moderate severity, but EPSS is less than 1%, pointing to a low exploitation probability. The vulnerability is not catalogued in KEV, yet an exploit has been publicly released. The primary threat comes from remote actors targeting the API endpoints, potentially achieving unauthorized access. The risk remains until a patch is applied, though current exploitation likelihood is low.