The vulnerability is a logic flaw in the validateToken() middleware of the @acastellon/auth module. The flaw permits bypass complete token validation by sending a request where the auth-user header equals "service‑brother" and the Host header starts with the service’s own hostname. the client, allowing the attacker to craft a request that skips the standard legacy, JWT, authentication is performed.

The affected product is the antonio‑castellon:module‑auth package; all releases older than version 2.3.0 are vulnerable. No other products or service versions are cited in the advisory.

The CVSS score of 8.7 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. Attackers can exploit the flaw remotely by issuing HTTP requests with spoofed auth-user and Host headers over any network path that reaches the vulnerable microservice, enabling unauthorized access to protected endpoints.