Executive brief
Spikster, a server management panel, contains a critical security flaw where its entire management interface is accessible without a password. An unauthorized person can remotely take full control of the management panel and every server it manages. This allows attackers to reset administrative passwords, read or delete sensitive files, and modify databases, potentially leading to complete data loss or system takeover.
Technical details
A missing authentication vulnerability (CWE-306) exists in Spikster through commit e1cdf8c. The root cause is a configuration error where the 'CipiAuth' middleware is registered in the application kernel but never actually applied to the API route group in the RouteServiceProvider or individual controllers. Consequently, approximately 50 critical API endpoints under the /api prefix are exposed to the public internet without credential requirements. An unauthenticated remote attacker can exploit this to enumerate managed servers, reset root passwords, perform arbitrary file read/write operations on the host, and create database users. As of the advisory date, the vulnerability is confirmed in the master branch, and remediation requires manually attaching the cipi.auth middleware to the API route group.
Affected products
- yolanmees Spikster through commit e1cdf8c4b780c87457b548c38a87982b549e2465
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory