The vulnerability arises in the application code of volotat Anagnorisis, specifically within an undetermined function in the app.py file that handles the Socket.IO Connect interface. An attacker can manipulate the input to bypass authentication checks, allowing remote execution of Socket.IO requests without credentials. This flaw enables unauthorized users to send arbitrary commands, potentially leading to data exposure, tampering, or escalation of privileges within the affected system.

volotat Anagnorisis versions up to 0.3.1 and 0.4.0 are vulnerable. The flaw resides in the Socket.IO Connect component of the application and applies to all installations running these versions.

The CVSS score of 6.9 reflects a moderate overall risk. EPSS is not available, so the precise likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The statement that the exploit has been made public and can be launched remotely indicates that the attacker only needs network access to the target system. The missing authentication check directly satisfies CWE-287 and CWE-306, elevating the potential for unauthorized access.