The vulnerability is in the SessionMiddleware of DevGuard, which, when no Kratos session cookie is present, accepts a client‑supplied X-Admin-Token HTTP header and treats its raw string value as the authenticated user ID. This authentication bypass allows an attacker who knows or can guess a target user’s Keystone identity UUID to issue requests as that user. If the target user holds organization‑level privileges, the attacker gains complete control over that organization’s DevGuard resources. The weakness is an authentication bypass (CWE‑288).

Vendors and products affected are l3montree‑dev’s DevGuard application, versions prior to 1.2.2. The issue is resolved in version 1.2.2 and later.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is not available, so the exact likelihood of exploitation is unknown, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be an unauthenticated HTTP request to the application with the X-Admin-Token header. If an attacker can determine a valid user UUID, the exploit can be performed from any location with network access to the DevGuard instance.