Neotoma’s authentication middleware incorrectly treats requests received over a loopback socket and lacking a Bearer token as coming from a local development user. This bypass allows an attacker to access the Inspector and API without credentials, resulting in potential data exposure, tampering, or further exploitation of the host environment. The flaw is rooted in missing authentication enforcement (CWE‑288) and an insecure default user model (CWE‑306).

The vulnerability affects Neotoma deployments from versions 0.6.0 through just before 0.11.1. The affected vendor is markmhendrickson: Neotoma. Any installation running an affected version and exposed to a reverse‑proxy that forwards traffic to the loopback interface is at risk.

The CVSS score of 6.9 reflects a moderate severity with potential for remote exploitation. No EPSS score is available, so the likelihood of exploitation cannot be quantified from the provided data. The vulnerability is not listed in CISA KEV, indicating no confirmed public exploits at this time. Attackers can exploit the flaw by configuring a reverse‑proxy to send requests over the loopback socket without a Bearer token, causing the backend to authenticate them as the local development user. This is a remote access scenario that does not require administrative credentials to the host.