The vulnerability in the /cas/login endpoint of sso-master v1.0.0 permits attackers to authenticate without providing a valid password by sending a specially crafted POST request. This bypass allows unauthorized users to gain access to the application, potentially exposing sensitive data and permitting further malicious actions. The flaw is a direct weakness in the authentication logic and represents an authentication bypass (CWE‑287).

sso-master version 1.0.0 is affected, specifically the /cas/login component. No vendor or product list is provided beyond the sso-master application.

The vulnerability appears to be exploitable remotely via the network, as attackers only need to send a POST request to the vulnerable endpoint. Because the EPSS score is not available and the CVE is not listed in the CISA KEV catalog, there is no reported exploit pressure data. Nonetheless, the ability to authenticate without credentials creates a high risk of confidentiality and integrity compromise. No detailed exploitation guide is publicly documented, but the described request can be constructed by an attacker to gain unauthorized access.