{"id":"CVE-2026-111626","published":"2026-10-16T18:17:42.583","lastModified":"2026-10-16T22:17:21.177","description":"Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs#L8-L53","tags":[]},{"url":"https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs#L238-L242","tags":[]},{"url":"https://github.com/Webreaper/Damselfly/issues/409","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/damselfly-api-missing-authorization","tags":[]},{"url":"https://www.vulncheck.com/advisories/webreaper-damselfly-through-4.5.3-missing-authentication-on-rest-api-controllers","tags":[]}],"exploitRefs":[{"url":"https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs#L8-L53","tags":[]},{"url":"https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs#L238-L242","tags":[]},{"url":"https://github.com/Webreaper/Damselfly/issues/409","tags":[]}],"hasPoc":true,"ai":{"summary":"A critical authentication bypass vulnerability exists in Webreaper Damselfly through version 4.5.3, where commented-out authorization attributes allow unauthenticated attackers to access all API routes and perform administrative actions like creating admin accounts or resetting any user's password.","exploitability":"The vulnerability is extremely easy to exploit with no prerequisites, requiring only a single HTTP request to bypass authentication and gain full administrative control.","blast_radius":"If exploited, this flaw could allow attackers to completely compromise the application by creating administrator accounts or resetting passwords for any user, leading to full system access and potential data exfiltration.","remediation":"Upgrade to version 4.5.4 or later to remediate this authentication bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","api","web","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:46:14.815Z"}}