The JTL‑WMS WMS MobileServer’s authorization middleware contains an authentication bypass. It fails to require authentication in two distinct cases: first, only GET and HEAD requests require an Authorization header; other HTTP methods are processed without authentication. Second, any request that includes a malformed or non‑bearer Authorization header is allowed to proceed even though no valid token is present. A remote attacker with network access can therefore invoke API functionality without credentials, leading to unauthorized access to protected resources.

The affected product is JTL‑WMS from JTL SW GmbH. All builds before the vendor’s published fix contain this flaw. Exact version numbers are not disclosed, so organizations should verify the JTL‑WMS version they run against vendor advisories.

The CVSS score of 10 indicates a critical severity. The EPSS score of less than 1% shows a very low but non‑zero probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog, which may indicate limited publicly known exploitation. An attacker can exploit this flaw remotely by sending crafted requests to the WMS MobileServer, exploiting the lack of authentication checks for certain HTTP methods or malformed headers. This allows the attacker to access API functionality without credentials, potentially exfiltrating data or performing privileged operations.