Technical impact
The vulnerability in the /cas/login endpoint of sso-master v1.0.0 permits attackers to authenticate without providing a valid password by sending a specially crafted POST request. This bypass allows unauthorized users to gain access to the application, potentially exposing sensitive data and permitting further malicious actions. The flaw is a direct weakness in the authentication logic and represents an authentication bypass (CWE-287, CWE-284).
Affected Systems
sso-master version 1.0.0 is affected, specifically the /cas/login component. No vendor or product list is provided beyond the sso-master application.
Risk and Exploitability
The vulnerability appears to be exploitable remotely via the network, as attackers only need to send a POST request to the vulnerable endpoint. Because the EPSS score is < 1% and the CVE is not listed in the CISA KEV catalog, there is no reported exploit pressure data. The CVSS score of 9.8 indicates critical severity, implying a high risk of confidentiality and integrity compromise if the flaw is used. No detailed exploitation guide is publicly documented, but the described request can be constructed by an attacker to gain unauthorized access.
