A critical authentication bypass vulnerability in Feast allows unauthenticated attackers to gain unauthorized administrative access to all system entities and data.

The application fails to verify JSON Web Token (JWT) signatures before processing user identity. An attacker can bypass role-based access control by providing an unverified token containing a hardcoded claim value, granting them unchecked read and write privileges across the server.

With a CVSS score of 9.8, this vulnerability represents a severe threat to data integrity and confidentiality. Unauthorized access to feature views, data sources, and permission policies can result in the compromise of sensitive data models, manipulation of production pipelines, and potential full system takeover.

Immediate Action: Update feast-dev feast to the latest version as soon as a patch is released. Until an update is available, restrict network access to the Feast server to trusted IP ranges only.

Proactive Monitoring: Monitor authentication logs for anomalous token usage or logins that originate from unexpected sources.

Compensating Controls: Implement strict network-level access controls and ensure that the Feast deployment is not exposed to the public internet.

Public Exploit Available: No (unknown)

This vulnerability is being actively exploited and represents a critical security emergency. Organizations must treat this as a high-priority incident, apply the patch as soon as it becomes available, and conduct a thorough audit of their Feast environment for signs of unauthorized access.