Vulnerability · Published Apr 26, 2026 · Assigned by VulDB

CVE-2026-7042666ghj MiroFish REST API Endpoint init.py create_app missing authentication

High 7.3

In plain English

A high-severity missing authentication in MiroFish from 666ghj. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in 666ghj MiroFish up to 0.1.2. This affects the function create_app of the file backend/app/__init__.py of the component REST API Endpoint. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
666ghj	MiroFish	0.1.00.1.10.1.2

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-359621 | 666ghj MiroFish REST API Endpoint __init__.py create_app missing authentication vdb-entry, technical-description
VDB-359621 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #798583 | 666ghj MiroFish 0.1.2 Missing Authentication for Critical Functions third-party-advisory
https://github.com/666ghj/MiroFish/issues/487 exploit, issue-tracking
https://github.com/666ghj/MiroFish/ product