The vulnerability is an authentication handling weakness in Artifactory’s internal request processing, which, under specific conditions, allows an attacker to bypass authentication and gain privileges beyond the intended access level. This flaw corresponds to CWE‑287 and can enable an unauthorized user to access or modify resources they should not be able to reach, potentially compromising data integrity and confidentiality. The description does not specify availability impacts directly, but elevated privileges could be used to disrupt service or disable features.

The affected product is JFrog Artifactory. No specific version information is provided in the input, so the advisory should be consulted for the exact affected releases. The weakness exists in the internal request handling component of Artifactory, and may affect all installed instances that utilize that component.

The CVSS score of 8.8 indicates a high severity issue, and the EPSS score of less than 1% suggests a low estimated exploitation probability, although an attacker can still exploit it if the conditions are met. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote exploitation of internal request paths or misconfigured internal access. An attacker could construct a request that is considered internal, then trigger the authentication bypass to elevate privileges. The risk remains high, especially for exposed Artifactory instances that allow internal request routing.