Krayin CRM version 2.2.4 contains a critical missing authentication vulnerability in its installer middleware. Unauthenticated remote attackers can bypass the CanInstall middleware redirect check by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header. The vulnerability targets the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert operation against the hardcoded administrator user ID. Attackers can supply arbitrary name, email, and password values to fully overwrite the primary administrator account. Successful exploitation grants full administrative access to all CRM data without any prior authentication. The flaw is categorized as a missing authentication vulnerability and carries a high criticality rating.