A missing authentication vulnerability in RansomLook allows unauthenticated attackers to access critical administrative functions, risking unauthorized system changes.

The application fails to perform necessary authentication checks (CWE-306) on the /admin/crypto/group/new endpoint. This allows an unauthenticated remote attacker to interact with sensitive administrative functionality.

An attacker gaining access to administrative crypto functions could potentially manipulate group settings or cryptographic configurations. While the CVSS score of 8.8 reflects high severity, the impact is primarily focused on administrative control and configuration integrity rather than full remote code execution.

Immediate Action: Apply the vendor-provided patch or update to the latest version of RansomLook to resolve the authentication bypass.

Proactive Monitoring: Review access logs for the /admin/crypto/group/new endpoint to identify any unauthorized requests originating from unknown IP addresses.

Compensating Controls: Implement strict firewall rules or WAF policies to restrict access to the /admin/ path to authorized administrative IP ranges only.

Public Exploit Available: No

This vulnerability represents a significant security oversight. Administrators should immediately restrict access to the affected administrative endpoint and apply the latest vendor update to ensure that authentication controls are properly enforced.