The vulnerability in SillyTavern allows an unauthenticated attacker to inject the Remote-User or X-Authentik-Username headers. Because the application performs no validation that these headers come from a trusted reverse proxy, the attacker can impersonate any user, including administrative accounts, and gain full control over the interface. This flaw is a direct authentication bypass (CWE‑290) combined with improper authorization checks (CWE‑306, CWE‑807). Successful exploitation leads to compromise of confidentiality, integrity, and availability for users of the service.

Affected systems are local deployments of SillyTavern with a configuration file that has either sso.autheliaAuth or sso.authentikAuth set to true. The issue exists in all releases prior to version 1.18.0; version 1.18.0 and later contain the necessary validation to ensure headers originate from a trusted source.

The CVSS score of 9.8 classifies this as a critical vulnerability, and while an EPSS score is currently unavailable, the lack of a KEV listing does not diminish the severity. Exploitation requires only network access to the SillyTavern port, which is typically local, so organization shouldn't ignore the issue. Because the vulnerability only manifests when SSO is enabled, the attack vector is a direct injection from a network client that can access the application host, and the exploitation can occur with no authentication prerequisites.