This vulnerability in Unraid allows remote attackers to bypass authentication without any prior credentials by exploiting improper path validation in the auth-request.php file. The flaw enables a crafted request to supply a user-controlled path that is used in authentication logic, resulting in unauthorized access to the system. The attack achieves high impact by granting an attacker full control over the Unraid installation, exposing all stored data and exposing the platform to further exploitation. The weakness corresponds to CWE-22: Path Traversal.

Affected vendor: Unraid; impacted product: Unraid OS 7.2.3. The cpe entry cpe:2.3:o:unraid:unraid:7.2.3:*:*:*:*:*:*:* indicates that only this version is listed as vulnerable; no other versions are explicitly reported as affected in the supplied data.

The CVSS v3 score of 7.3 indicates medium‑to‑high severity. EPSS shows a probability of exploitation of less than 1 %, suggesting that while the vulnerability is high impact, the likelihood of real‑world exploitation is currently low, and it has not yet entered CISA’s KEV catalog. Attackers can exploit this by sending a crafted HTTP request to auth-request.php containing a malicious path; the vulnerability exists remotely and does not require authentication to be used.