CVE-2026-111626

Summary

A critical authentication bypass vulnerability exists in Webreaper Damselfly through version 4.5.3, where commented-out authorization attributes allow unauthenticated attackers to access all API routes and perform administrative actions like creating admin accounts or resetting any user's password.

Exploitability

The vulnerability is extremely easy to exploit with no prerequisites, requiring only a single HTTP request to bypass authentication and gain full administrative control.

Blast radius

If exploited, this flaw could allow attackers to completely compromise the application by creating administrator accounts or resetting passwords for any user, leading to full system access and potential data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.5.4 or later to remediate this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.