The CVSS 7.5 on this admin panel authentication bypass deserves scrutiny, but not for the reason you might expect. EAR vulnerabilities—where the application redirects to login but continues processing the original request—are trivially discoverable with basic proxy tooling, yet the EPSS sits at just 0.00373. That gap between exploitability and observed exploitation likely reflects the vendor's visibility threshold rather than genuine difficulty: attackers have learned this vendor's patch cadence and may be timing campaigns accordingly.
The more concerning signal is the 'through 28072026' version notation. Date-based versioning correlates strongly with release processes where security review is bolted on post-deployment, not baked into the pipeline. When you see this pattern, expect clustering: EAR, IDOR, and broken access controls tend to appear together in the same release branches because they stem from the same architectural root—weak request termination logic running through every authorization check.
The CVSS score itself may be technically accurate by the formula, but the formula wasn't designed for this context. An EAR in an admin panel isn't a discrete vulnerability—it opens access to whatever legacy trust model that oldest authentication layer encodes. The panel touches user data, system configs, and integrations that are likely undocumented given the vendor's version control discipline. The actual blast radius is unknowable, which is worse than a known large one.
If you're defending this product: treat the admin panel as fully compromised architecture, not a single vulnerability. Audit all authentication and session management primitives for the same request lifecycle handling flaw. The EAR is likely one node in a genetic sequence of weaknesses, not an isolated mutation.