The vulnerability in Spikster exists because the authentication middleware is registered but never applied to any API route. This missing authentication grants unauthenticated remote attackers the ability to access all API endpoints, allowing them to enumerate system resources, provision new servers, reset root passwords, read and write arbitrary files, and create database users. Such capabilities can lead to full compromise of the host and the service infrastructure.

Spikster product from yolanmees. The affected code includes commit e1cdf8c; any deployment that has not yet been updated to a version where CipiAuth middleware is correctly attached to routes is vulnerable.

The CVSS score of 9.3 highlights the critical severity of this issue, and the EPSS score of less than 1% indicates a low but present exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the exposed API routes remotely, requiring only network connectivity to the service. Because the middleware is never enforced, no additional credentials or privileged access are needed, making the attack path straightforward for an unauthenticated attacker.