The vulnerability exists in Apache bRPC when both ServerOptions.auth and ServerOptions.internal_port are enabled. In this configuration, the internal_port exemption allows a built‑in service request to authenticate a connection without checking credentials, and this verification result latches for the entire connection. A remote attacker can send an initial request, such as GET /status, to gain authentication, and then issue further requests to standard services on the same connection, bypassing authentication entirely. This results in unauthenticated access to ordinary services, compromising confidentiality and integrity of data served over the affected ports.

The issue affects any Apache bRPC server that enables both authentication and an internal_port configuration. This includes all deployed Apache bRPC instances that use ServerOptions.auth together with ServerOptions.internal_port, regardless of version prior to the 1.18.0 fix, and applies to all system architectures supported by the bRPC library.

The vulnerability allows remote attackers to bypass authentication and gain unauthorized access to services over HTTP. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog; however, the severity is high due to the complete loss of authentication controls. The attack can be carried out over any network path that exposes the internal_port, making it possible for an attacker to initiate the exploit from an external location without additional credentials.