Missing Authentication Vulnerability in Spikster API
CVE-2026-67594

9.3CRITICAL

Key Information:

Vendor

Yolanmees

Status
Spikster
Vendor
CVE Published:
30 July 2026

What is CVE-2026-67594?

The Spikster API is vulnerable due to a missing authentication issue that allows unauthenticated remote attackers to exploit misconfigured API routes. Specifically, this vulnerability arises from the CipiAuth middleware, which, although registered, is not applied to any API route, enabling attackers to access approximately 50 unprotected endpoints. Through this loophole, they can enumerate and provision servers, reset root passwords, interact with arbitrary files on the host, and create database users, posing a significant risk to the integrity and security of the affected system.

Affected Version(s)

Spikster 0

References

https://github.com/yolanmees/Spikster/issues/24
technical-description
https://www.vulncheck.com/advisories/spikster-missing-aut...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fatullayev Asadbek
.