Anonymous By Registration

A controller's default-deny authentication posture is opt-out by registration: an array, decorator, or route attribute marks individual actions as callable without a session. The developer uses the opt-out and writes no compensating check inside the handler body. The registration IS the authorization decision; no caller identity is consulted at any layer. The CVE names the action that was registered without a compensating check.