CVE-2026-9033 is a session destruction endpoint that operates without any authentication requirement. In practice, this means an unauthenticated attacker can terminate active user sessions by issuing a request to a specific endpoint — creating a denial-of-service vector against any user currently authenticated through the affected captive portal or authentication system.
This is not a subtle logic bug. It's a missing access control decision that should have been made during design, not discovered after deployment. The endpoint was likely coded as an admin utility and assumed to be network-local or otherwise protected by infrastructure assumptions. That assumption shipped, and no one caught it in review.
What you should do: First, verify whether your deployment exposes this endpoint to untrusted networks. If the endpoint is reachable from user-facing interfaces, it's exploitable regardless of how unlikely active exploitation appears. Second, treat this CVE as a diagnostic signal — if session termination lacks authentication, audit your other session-management operations (session invalidation, token refresh, session state queries) for the same gap. The same development pattern that produced this flaw likely produced others. Third, examine the actual fix your vendor shipped. A proper fix introduces centralized authorization middleware that the endpoint inherits. A symptom-level fix adds a local auth check and leaves other endpoints vulnerable. If you can't determine which fix you have, assume the latter and prioritize a broader audit.
The low EPSS score (0.00185) tells you this is unlikely to be exploited in the wild right now — not that the vulnerability doesn't matter. This is the kind of clearly-bounded, unauthenticated access control gap that should have been caught in a proper API security review. The exploitability is boring; the development process failure isn't excusable.