Medium severity · published May 24, 2026
CVE-2026-9371
ItzCrazyKns Vane API route.ts missing authentication
5.6
CVSS
0.4%
EPSS
No
On KEV
Description
A security vulnerability has been detected in ItzCrazyKns Vane up to 1.12.1. Affected by this issue is some unknown functionality of the file route.ts of the component API. The manipulation leads to missing authentication. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been disclosed publicly and may be used. It appears that basic authentication is planned.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vane · ItzCrazyKns
1.12.0; 1.12.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9371
github.com
https://github.com/ItzCrazyKns/Vane/
github.com
https://github.com/ItzCrazyKns/Vane/issues/1122
github.com
https://github.com/ItzCrazyKns/Vane/issues/1123
vuldb.com
https://vuldb.com/submit/813209
vuldb.com
https://vuldb.com/submit/813210
vuldb.com
https://vuldb.com/vuln/365334
More from Vane
7.3
CVE-2026-9372
ItzCrazyKns Vane Model Provider API route.ts server-side request forgery
