This vulnerability, which is an authentication bypass via spoofed X-Agentic-Ally-Token in Keepnet Labs Cybersecurity Inc.’s Agentic AI / Agentic Ally, allows an attacker to forge the authentication token and gain unauthorized access to the system. The weakness is an improper authentication flaw (CWE‑290), meaning the application accepts the forged token without adequate verification.

The affected product is Keepnet Labs Cybersecurity Inc.’s Agentic AI / Agentic Ally. Users running any version before the commit identifier 0ef61f2e are susceptible.

The CVSS score of 7.5 indicates a high severity risk, but the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Given that the flaw involves accepting an unauthorized API token, the likely attack vector is remote over the network and does not require local privileges. Exploitation would enable an attacker to impersonate authenticated users and potentially access sensitive data or manipulate system behavior.