A CVSS 9.8 broken authentication vulnerability in a booking system demands more than patching — it demands understanding why auth was structurally absent rather than merely misconfigured. The EPSS of 0.00404 is the first signal worth tracing: this low score suggests discovery came through code review or domain-specific security auditing rather than automated scanning, which means the vulnerable endpoint was obscure enough that even automated recon missed it. This isn't a sign the vulnerability is hard to exploit — it's a sign no one was looking.
Your investigation should run in three directions simultaneously. First, backward through version control: pull the git history around when this endpoint was introduced and look for commits that explicitly removed or stubbed authentication checks. The pattern is well-documented in this class of bug — developers disable auth temporarily to unblock frontend integration, the PR review focuses on booking logic correctness, and security is never re-verified before merge. If you find commits that explicitly bypassed auth, that indicates awareness rather than ignorance, which changes your remediation timeline and communication strategy. Second, check your deployment topology for orphaned instances: version 10.30.26 is a geological marker suggesting this code shipped on a branch that may have been superseded. Look for staging environments, backup instances, or old mobile app API endpoints that were never decommissioned when the main system moved forward. Abandoned code doesn't disappear — it just stops being reviewed. Third, model the forward blast radius: a booking system is a hub, not a wall. Unauthenticated access to appointment data exposes client contact information, appointment histories, staff schedules, and critically, the integration surface with payment processors, SMS gateways, and calendar webhooks. The CVSS 9.8 tells you the blast is large; the booking system context tells you where the shrapnel lands — every client whose data touched this system, every downstream service that trusts this booking data, and every lateral path that trust enables.
Prioritize patching within 24 hours of patch availability. The low EPSS at discovery is the calm before the storm — once this endpoint enters crawler signatures or a PoC circulates, the exploitation window compounds rapidly regardless of automated exploitability. If your organization runs older versions of this software, treat this CVE as a canary: where there's one forgotten route, there are usually forgotten services. Check for legacy branches, abandoned staging environments, and old mobile app backends that may share the same structural auth gap.