The vulnerability lies in the SecurityConfig.java file of the api-docs endpoint of zhistaredu StarTraining. An attacker can manipulate the endpoint to bypass its authentication mechanism, as indicated by the missing authentication handling. This allows unauthorized users to access the Swagger API documentation, potentially revealing internal API routes, parameters, and other sensitive information. The flaw is an authentication bypass (CWE-287) and a missing authentication implementation (CWE-306).

The issue affects zhistaredu StarTraining versions up to and including 3.8.1. No specific patch version is listed, but any release newer than 3.8.1 is presumed to contain the fix.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. An attacker can exploit the flaw remotely by crafting HTTP requests to the Swagger /api-docs endpoint; it is inferred that the attack vector is via HTTP web traffic. Publicly released exploit code increases the likelihood that the vulnerability will be actively used until patched.