Spikster, through commit e1cdf8c, contains a critical missing authentication vulnerability affecting all API routes. The CipiAuth middleware is registered but never applied to any route in the API routing configuration, leaving approximately 50 API endpoints completely unprotected. Unauthenticated remote attackers can exploit this flaw to enumerate and provision servers, reset root passwords, read and write arbitrary files on the host system, and create database users. The vulnerability requires no credentials or special access, making it trivially exploitable by any remote attacker. The impact is severe as it grants near-complete control over managed servers and hosted infrastructure. A GitHub issue and VulnCheck advisory have been published detailing the flaw.