The vulnerability resides in 666ghj MiroFish version 0.1.2 and earlier, specifically in the create_app function of backend/app/__init__.py. The flaw causes an authentication bypass for the REST API endpoint, enabling attackers to perform manipulation remotely. This allows unauthorized users to access sensitive functionality or data exposed by the API.

All instances of 666ghj MiroFish up to and including version 0.1.2 are impacted. No specific sub‑components or configuration variations are listed beyond the cited file and version range.

The CVSS score of 6.9 indicates a moderate to high risk level for successful exploitation. The EPSS score of <1% signals a low probability of exploitation at this time, and the vulnerability is not listed in the CISA Key Exploited Vulnerabilities catalog. The attack vector is remote, and an exploit has already been published, meaning that a threat actor could trigger the authentication bypass from outside the network.