An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.

CVE-2026-27546 describes a critical authentication bypass vulnerability in the _account_log function that allows unauthenticated remote attackers to gain administrative access. The flaw can be exploited even when accounts are properly configured, meaning standard security hardening does not mitigate the risk. No authentication credentials are required, making this trivially exploitable by any remote attacker. The vulnerability has been reported via NVD and multiple CERT-VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), suggesting it affects multiple product versions or vendors. The ability to log in as admin without credentials represents a complete authentication control failure. This type of vulnerability typically leads to full system compromise, data exfiltration, and lateral movement. The involvement of CERT-VDE indicates the affected products are likely industrial or embedded systems.