/Vulnerability Library

OpenFlagr <= 1.1.18 - Authentication Bypass

CVE-2026-0650
Verified

Description

OpenFlagr <= 1.1.18 contains an authentication bypass caused by improper path normalization handling in HTTP middleware whitelist logic, letting attackers access protected API endpoints without valid credentials, exploit requires crafted requests.

Severity

Critical

CVSS Score

9.3

Exploit Probability

2%

Affected Product

flagr

Published Date

September 6, 2026

Template Author

str4k3r

CVE-2026-0650.yaml
9.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE ID:
cve-2026-0650
CWE ID:
cwe-22

References

https://github.com/advisories/GHSA-rwp9-5g7q-73q3https://github.com/openflagr/flagr/commit/fe83dc87aa404a57554aa5839ac450f55c203570https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypasshttps://nvd.nist.gov/vuln/detail/CVE-2026-0650

Remediation Steps

Update to the latest version beyond 1.1.18.