This is even more severe. The RCE is the simplest RCE you can ever imagine. Simply remove the auth header and you are root. remotely. on all machines. Is this really 2021?
if only there was
some way
to represent "not there" out of band of whatever the "there" type is
we could call it "Maybe"
alas, this fanciful technology shall never be