Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck

CVE-2026-67594Spikster Missing Authentication via API Route Group

Critical 9.8

In plain English

A critical-severity missing authentication in Spikster from yolanmees. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 41.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers can invoke approximately 50 unprotected API endpoints to enumerate and provision servers, reset root passwords, read and write arbitrary files on the host, and create database users.

Affected products (as reported)

Vendor	Product	Versions
yolanmees	Spikster	0 – through e1cdf8c4b780c87457b548c38a87982b549e2465

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, issue-tracking
https://www.vulncheck.com/advisories/spikster-missing-authentication-via-api-route-group third-party-advisory