Progress MarkLogic Server versions 12.x older than 12.1.0 and 11.x older than 11.3.7 contain an authentication validation weakness that allows an attacker to use an OAuth token that the server should reject, resulting in unauthorized access to protected resources. The flaw is a classic authentication bypass, classified under CWE‑287. The vulnerability enables the attacker to impersonate a legitimate user or elevate privileges without the need for valid credentials.

MarkLogic Server from Progress Software is affected when running versions 12.x prior to 12.1.0 or 11.x prior to 11.3.7. All installations of these releases that have not applied the vendor’s critical update are potentially vulnerable.

The CVSS score of 7.5 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an off‑site attacker who can craft or obtain an OAuth token and send it to the affected server; this does not require privileged local access. If successful, the attacker gains unauthorized access to data and services, making the impact both confidential and potentially critical for business operations.