Penpot, an open‑source design tool for design and code collaboration, allowed any user with a valid team‑invitation token to create a session for another account without a password. The flaw originates from the service exposing invitation tokens for team creation, embedding existing profile identifiers into the registration flow, and granting a session when the invitation email matches a registered account. This constitutes an Authentication Bypass (CWE-287) and an Authorization Bypass (CWE-639), letting a non‑blocked target account be taken over by an attacker lacking legitimate credentials.

All Penpot installations running a version earlier than 2.14.5 are affected. The vulnerability applies to the penpot:penpot product. No specific sub‑version scope was listed, so any release prior to 2.14.5 could be vulnerable.

The CVSS score of 9.9 indicates a critical severity, and the EPSS score of < 1 % shows a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote request to the invitation token endpoint, where an attacker supplies a valid token and matching email to obtain an unauthorized session. Successful exploitation requires only possession of a team‑invitation token, which can be obtained by any user who can trigger or observe an invitation workflow. No local privilege escalation or code execution is necessary; the risk is solely about taking control of existing user accounts.