CVE-2026-9371
ItzCrazyKns Vane API route.ts missing authentication
CVSS Score
5.6
EPSS Score
0.1%
EPSS Percentile
18th
A security vulnerability has been detected in ItzCrazyKns Vane up to 1.12.1. Affected by this issue is some unknown functionality of the file route.ts of the component API. The manipulation leads to missing authentication. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been disclosed publicly and may be used. It appears that basic authentication is planned.
| CWE | CWE-306 CWE-287 |
| Vendor | itzcrazykns |
| Product | vane |
| Published | May 24, 2026 |
| Last Updated | May 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for itzcrazykns vane
Be the first to know when new medium vulnerabilities affecting itzcrazykns vane are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
ItzCrazyKns / Vane
1.12.0 1.12.1
References
vuldb.com: https://vuldb.com/vuln/365334 vuldb.com: https://vuldb.com/vuln/365334/cti vuldb.com: https://vuldb.com/submit/813209 vuldb.com: https://vuldb.com/submit/813210 github.com: https://github.com/ItzCrazyKns/Vane/issues/1122 github.com: https://github.com/ItzCrazyKns/Vane/issues/1123 github.com: https://github.com/ItzCrazyKns/Vane/
Credits
🔍 Yu-Bao (VulDB User) VulDB CNA Team