An unauthenticated remote authentication bypass vulnerability in Alteryx Server allows attackers to gain full session access, posing a severe risk to data integrity and system control.

The vulnerability exists due to improper authentication handling within the /gallery/api/status/ endpoint. An unauthenticated attacker can send a crafted POST request to the /gallery/api/auth/sessions/ endpoint to obtain a valid session identifier, effectively bypassing all authentication controls.

Successful exploitation grants an attacker full access to the Alteryx Server environment, enabling them to impersonate users, create new accounts, and access sensitive data processed within the gallery. With a CVSS score of 7.3, this high-severity flaw provides a direct path to unauthorized administrative control over business intelligence workflows.

Immediate Action: Update to the patched versions: 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125, or 2025.1.1.1.31. Please note that older versions such as 2020, 2021, and 2022 will not receive patches and must be upgraded to a supported version.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at /gallery/api/auth/sessions/ and investigate any unauthorized session creation events.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block requests containing suspicious JSON payloads targeting the authentication session API.

Public Exploit Available: Yes, a functional proof-of-concept script has been published on GitHub.

Given the availability of a functional exploit and the ease of execution, administrators should prioritize upgrading their Alteryx Server instances immediately. Organizations running legacy versions that are no longer supported must plan for an urgent migration to a current, patched release to eliminate this exposure.