A critical authentication bypass flaw in springboot-project v1.0.0 allows unauthenticated attackers to fully compromise seller management operations, including order and product manipulation.

This is an access control vulnerability located in the SellerAuthorizeAspect component. It allows unauthenticated remote attackers to bypass security checks and interact with sensitive seller management interfaces.

The ability for an unauthenticated attacker to list products, cancel orders, and modify categories poses a severe risk to business operations and data integrity. With a CVSS score of 9.1, this vulnerability is classified as critical, as it allows for unauthorized administrative control over commercial transactions and inventory management, potentially leading to significant financial loss and reputational damage.

Immediate Action: Since no official patch is currently identified, users should restrict access to the affected management interfaces via network-level controls or by disabling the vulnerable component if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous traffic patterns directed at seller management endpoints or unexpected administrative activity originating from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to paths associated with seller management interfaces until a vendor-supplied update is available.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's technical write-up referenced in the CVE record.

Given the critical nature of this flaw and the existence of a public proof-of-concept, organizations must prioritize the isolation of the affected springboot-project instance immediately. Administrators should monitor vendor channels for the release of a security update and apply it as soon as it becomes available to remediate the underlying access control defect.