A critical authentication bypass in Krayin CRM allows unauthenticated attackers to perform an account takeover of the primary administrator profile.

The vulnerability exists in the installer middleware, where a flaw in the CanInstall redirect check allows attackers to bypass authentication. By sending a crafted HTTP POST request with a specific header, an attacker can access the admin-config-setup endpoint to overwrite the primary administrator credentials.

Successful exploitation grants an attacker full administrative access to the CRM platform. This results in the potential loss of sensitive customer data, unauthorized configuration changes, and complete compromise of business information stored within the application. Given the CVSS score of 9.8, this vulnerability is critical as it completely invalidates the security model of the CRM.

Immediate Action: Update krayin laravel-crm to a patched version (specifically those outside the range of 2.2.0 through 2.2.4, such as 2.2.1 through 2.2.3 if applicable per vendor guidance).

Proactive Monitoring: Audit user account logs for unexpected changes to the administrator account and monitor for unauthorized access to the admin-config-setup endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing the X-Requested-With: XMLHttpRequest header directed at the installer endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists via security research write-ups.

This is a critical security vulnerability that directly threatens the integrity and confidentiality of the CRM database. Administrators should verify their current version and apply the vendor-recommended patches immediately to prevent unauthorized administrative account creation and potential data breaches.