{
  "claim_outcome": "confirmed",
  "repro_result": "confirmed",
  "evidence_scope": "production_path",
  "observed_impact_class": "authz_bypass",
  "claimed_impact_class": "authz_bypass",
  "exploitability_confidence": "high",
  "attacker_controlled_input": "Authorization: Bearer 88ec0c6a-13ce-5e39-b486-354fe4a7084f (hardcoded default-admin internal_id, no credentials) on unauthenticated POST /graphql",
  "trigger_path": "HTTP POST /graphql -> authenticateUserFromRequest -> authenticateUserByTokenOrUserId -> user cache map keyed by internal_id/standard_id/api_token (opencti-graphql src/domain/user.js, src/database/cache.ts)",
  "claimed_surface": "api_remote",
  "validated_surface": "api_remote",
  "end_to_end_target_reached": true,
  "sanitizer_used": false,
  "crash_observed": false,
  "read_write_primitive_observed": false,
  "exploit_chain_demonstrated": true,
  "inferred": false
}