A flaw in the createDevContext function of the runAuth middleware enables attackers to bypass authentication through an alternate channel. This results in unauthorized access to protected resources. The weakness is identified as CWE-287 and CWE-288, indicating an authentication bypass and authentication‑related error. The impact is loss of confidentiality and integrity for users authenticated through this channel.

The vulnerability affects inkeep agents version 0.58.14. No other versions are listed as affected, and no additional vendors or products are identified. The software resides in the agents-api/src/middleware/runAuth.ts component of the inkeep agents project.

The CVSS score of 6.9 indicates a high severity and the EPSS score is not available, implying insufficient data on exploitation probability. The exploit is publicly available and can be carried out remotely, although the project has not provided a fix yet. Because it is listed in neither KEV nor any public exploit forums, widespread exploitation may still be limited, but the remote nature of the attack vector and authentication bypass pose significant risk.