PikiwiDB (Pika) v3.5.7 accepts incoming replication connections on a port derived from the client port plus 2000, and these connections are not authenticated except for a single handler that checks the requirepass password. Because the frame dispatcher does not enforce this check before routing other message types, an attacker can send replication control commands such as TrySync, DBSync, BinlogSync, and RemoveSlaveNode without any credentials, allowing download of a full‑sync snapshot, subscription to the live write stream, and deletion of replica nodes, thereby exposing the entire database and disrupting replication. This is a classic authentication bypass (CWE‑306).

The vulnerability affects OpenAtomFoundation PikiwiDB (Pika) version 3.5.7. The replication server module that derives the listening port from the client port and exposes it without authentication is the only component impacted.

The CVSS v3 score is 8.8, indicating high severity. The EPSS score is not available, so the current probability of exploitation is uncertain, although the exploit path is straightforward: an attacker needs only network reachability to the internal protobuf port (for example, 11221 when the client uses 9221) and can send privileged replication commands without credentials. The vulnerability is not listed in CISA’s KEV catalog, but the lack of authentication makes it an attractive target for attackers.