Apache bRPC 1.18.0 and earlier contain a flaw that allows a remote, unauthenticated user to send streaming RPC frames directly to a server that is configured for authentication. Because the streaming frames bypass the authentication hook, the attacker can inject or deliver malicious frames, potentially causing unauthorized data exchange or other unintended behavior. The weakness corresponds to CWE-306: Missing Authentication for a Function.

The vulnerability applies to Apache Software Foundation’s Apache bRPC on all platforms for versions older than 1.18.0. Any deployment where the bRPC server is exposed to an untrusted network and is configured with authentication is affected.

The issue presents a high potential impact due to its remote authentication bypass nature, with a CVSS score of 9.1. The EPSS score is a very low but nonzero 0.00261 (< 1%), indicating a very low but existent exploitation probability, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw from any external network connection that can reach the bRPC server. Because the vulnerability permits injection of arbitrary streaming frames, the consequence could range from data tampering to denial of service or further lateral movement, depending on how the server processes frames. The extremely low EPSS score reflects the rarity of public exploitation, yet the lack of authentication checks makes this an attractive target for attackers.