A critical authentication bypass vulnerability has been discovered in 666ghj MiroFish versions up to 0.1.2. The flaw affects the create_app function in the REST API endpoint, allowing remote attackers to bypass authentication mechanisms. The vulnerability can be exploited remotely and a public exploit is available. The issue was reported to the project maintainers but they have not yet responded to address the security concern.