Borg SPM 2007 contains an authentication bypass flaw that allows an unauthenticated attacker to log in as any user on the system. The vulnerability enables fully privileged access without the need to supply valid credentials, potentially exposing sensitive data, configuration files, and administrative controls. The weakness is identified as CWE-1390, indicating a flaw in the authentication mechanism.

The product is Borg SPM 2007 from BorG Technology Corporation. The system was sold until 2008, and no specific sub‑versions are mentioned beyond the product name. No affected version list is available.

The CVSS score of 9.3 classifies the flaw as Critical, and the EPSS score of less than 1% suggests a very low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and unauthenticated, meaning that an attacker requires only network access to the service to attempt a login bypass. If successful, the attacker can act with the privileges of the account that is injected.