{"id":"EUVD-2026-24477","enisaUuid":"4bfce0de-138d-3eba-bd7a-4a8f25c3de3d","description":"frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1.","datePublished":"Apr 21, 2026, 8:09:00 PM","dateUpdated":"Apr 21, 2026, 8:28:48 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9\n","aliases":"CVE-2026-40910\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"925dfaf5-d16a-35ad-98e6-dc5fcd9a7ae6","product":{"name":"frp","vendor":{"name":"fatedier"}},"product_version":"\u003c 0.68.1"}],"enisaIdVendor":[{"id":"f9ab42ed-f4c1-371c-a1bc-3ccf811032eb","vendor":{"name":"fatedier"}}],"enisaIdVulnerability":[{"id":"a55b735f-9d5d-323f-8af9-cfabbc3e522f","vulnerability":{"id":"CVE-2026-40910","description":"frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1.","datePublished":"Apr 21, 2026, 8:09:00 PM","dateUpdated":"Apr 21, 2026, 8:28:48 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9\n","enisa_id":"EUVD-2026-24477\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Oct 27, 2026, 7:16:48 AM","vulnerabilityProduct":[{"id":"5bc452f3-b053-3a7c-b34c-12d263438feb","product":{"name":"frp","vendor":{"name":"fatedier"}},"product_version":"\u003c 0.68.1"}],"vulnerabilityVendor":[{"id":"484b2146-3a09-33d2-b883-31a7e0b9cc60","vendor":{"name":"fatedier"}}]}}],"enisaIdAdvisory":[]}