A flaw in the login logic of the Kaleris Yard Management System (YMS) version 7.2.2.1 allows malicious users to bypass authentication checks and gain access to the application’s protected resources without providing valid credentials. The impact is the potential acquisition of confidential data, manipulation of yard operations, or execution of further actions that require authenticated access.

This vulnerability affects the Kaleris Yard Management System, specifically release 7.2.2.1. The system is used by organizations to manage yard operations and inventory, and the error is present in the core authentication module provided by the vendor.

No CVSS score, EPSS evaluation, or KEV tagging is available for this vulnerability, making the precise severity difficult to quantify. However, the ability to log in without credentials implies a high impact on confidentiality, integrity, and availability of the system. The likely attack vector is a remote web interface where an attacker can submit crafted requests to the login endpoint, enabling exploitation over the network without requiring local privileges. Given the critical nature of authentication bypasses, the risk level should be treated as high until a patch or effective workaround is applied.