A flaw in the middleware authentication checks of Cronmaster allows unauthenticated users to be treated as authenticated when an invalid session cookie results in a failed session‑validation fetch. As a consequence, attackers can view protected pages and trigger privileged Next.js Server Actions without proper credentials. The vulnerability stems from improper session handling (CWE‑287, CWE‑306, CWE‑693).

The issue affects the fccview Cronmaster application, specifically all releases before version 2.2.0. Any deployment using these older versions is susceptible until patched.

The CVSS v3 score of 8.3 indicates high severity, while no EPSS data is available and it is not listed in KEV. The likely attack vector is an unauthenticated HTTP request sent to any protected endpoint. If exploited, an attacker could obtain privileged access that may lead to further compromise. Given the lack of a hard‑coded exploitation method in the description, de‑risking requires patching the middleware rather than solely relying on defensive controls.