CVE-2026-72605

The CVSS 7.5 score masks the real problem: this isn't a forgotten JWT implementation detail—it's an architectural decision to permanently exempt /auth/profile/create from authentication. Someone explicitly allowlisted this endpoint, which means the application ships with a permanent unauthenticated registration API accessible to anyone who can reach the server. This changes the incident response calculus. A single-patch approach—adding JWT verification to this endpoint—may close this specific hole but ignores what the allowlist pattern tells you about the codebase. Once a team has accepted that some endpoints live outside the auth boundary, the path of least resistance is to add the next onboarding flow without revisiting the architectural assumption. You should audit the entire allowlist: every exempted path represents a routing decision that authentication is optional there, and that pattern tends to propagate. The privilege escalation angle matters here. Ask whether newly registered accounts can gain meaningful permissions through the application's own functionality—role assignments, admin panel access, reserved usernames. If the application has RBAC, the ability to register arbitrary accounts is only the first step. Even if registration yields 'basic user' status, a programmatic registration endpoint becomes a staging ground for enumeration: probing for admin creation workflows, testing reserved usernames, or discovering other authenticated endpoints that expose sensitive functionality. Beyond this specific endpoint, treat the existence of an allowlist as evidence of a systemic pattern. There are almost certainly other bypassed flows that haven't been reported. Your remediation isn't 'patch and monitor'—it's audit the allowlist, understand why each entry exists, and determine whether the original justification still holds. If the endpoint was intended for first-admin creation or one-time onboarding, verify whether that use case is still valid or whether the exemption should be removed now that the initial setup is complete. The most dangerous assumption is that this endpoint was 'just for onboarding' and therefore contained—it's not contained, it's a registration API that attackers will find and hammer.

Reviewed through automated stages and approved by a human before publication.