In NATS Server, a client connecting before the CONNECT command can be registered as the configured no_auth_user through a parsing path intended only for the first operation. This mis‑routing bypasses the normal authentication enforcement applied to clients, such as allowed_connection_types or proxy_required checks. As a result, an attacker can assume the rights of no_auth_user and potentially publish or read messages that would normally be restricted. The weakness is an example of insufficient authentication checks (CWE-863).

NATS Server from nats-io, versions earlier than 2.14.3 and 2.12.12 are vulnerable; these issues are resolved in 2.14.3, 2.12.12, and later releases.

The CVSS score of 5.4 designates this vulnerability as medium severity. With an EPSS score below 1 %, the likelihood of exploitation is considered low, and it is not listed in the CISA KEV catalog. The likely attack vector involves an adversary establishing a TCP or TLS connection to the NATS endpoint and sending a command that is not CONNECT as the very first message, triggering the fast‑path parser and bypassing authentication. Anyone with network access to the server can perform this action; the actual damage depends on the permissions granted to the no_auth_user role.