Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived, contains a flaw that allows authentication bypass through the use of the substring "api" in URLs and an unauthenticated /api/gpt endpoint. The vulnerability is a classic case of authentication failure (CWE-287) compounded by the missing authentication check (CWE-306) and an incorrect comparison logic (CWE-697). The result is that an attacker can gain the same level of access as a legitimate logged‑in user without providing credentials, effectively turning the management interface into an open door for further malicious activity.

The affected product is Roxy-WI version 8.2.6.4 and earlier. All installations of those releases that expose the web management console are susceptible until a patch is applied or access control is tightened.

The CVSS score of 8.3 classifies this issue as High, indicating that exploitation could allow end users to perform privileged operations and potentially compromise the underlying servers. While the EPSS score is not available, the nature of the flaw suggests that a remote attacker could craft a URL containing the substring "api" or target the public /api/gpt endpoint and bypass authentication. The vulnerability is not currently listed in CISA KEV, but its high severity and lack of a publicly available fix warrant careful monitoring of exploit activity and prompt mitigation.