CyberPanel versions prior to 2.4.4 contain an authentication bypass that allows unauthenticated attackers to write arbitrary data to the database through the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. This flaw, classified as CWE-306, can lead to denial of service via storage exhaustion, corrupt scan history entries, and data pollution. The primary impact is the compromise of data integrity and availability for any user with network access to the service.

The vulnerability affects all instances of CyberPanel (usmannasir:cyberpanel) using versions before 2.4.4. No specific sub‑version list is provided, but any release older than 2.4.4 is susceptible.

The CVSS score of 8.8 indicates high severity, yet the EPSS score of less than 1% demonstrates that exploitation is currently considered rare. The flaw is not listed in the CISA KEV catalog. Attackers would likely target the exposed API endpoints over the network, bypassing authentication entirely to inject malicious data or trigger resource exhaustion. Given the lack of mitigations and the broad exposure of the endpoints, systems with publicly accessible API routes remain at significant risk until a patch or workaround is applied.