{"id":"EUVD-2026-41013","enisaUuid":"bf0c0bb4-e631-3fd2-8238-3a8c0d4b38a2","description":"@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get(\u0027host\u0027).startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs. A fix has been implemented in v2.3.0.","datePublished":"Jul 1, 2026, 2:25:44 PM","dateUpdated":"Jul 2, 2026, 2:26:00 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw\nhttps://github.com/antonio-castellon/module-auth/issues/6\nhttps://www.npmjs.com/package/@acastellon/auth/v/2.3.0\n","aliases":"CVE-2026-58399\n","assigner":"GitHub_M","epss":0.97,"enisaIdProduct":[{"id":"34d9ed43-b860-322d-9b9d-f3316fd81446","product":{"name":"module-auth","vendor":{"name":"antonio-castellon"}},"product_version":"\u003c 2.3.0"}],"enisaIdVendor":[{"id":"0eb592c7-33de-3b89-a40e-fc7a150b87e2","vendor":{"name":"antonio-castellon"}}],"enisaIdVulnerability":[{"id":"2854764c-c215-3c48-bcfb-64905d7e40c6","vulnerability":{"id":"CVE-2026-58399","description":"@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get(\u0027host\u0027).startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs. A fix has been implemented in v2.3.0.","datePublished":"Jul 1, 2026, 2:25:44 PM","dateUpdated":"Jul 2, 2026, 2:26:00 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw\nhttps://github.com/antonio-castellon/module-auth/issues/6\nhttps://www.npmjs.com/package/@acastellon/auth/v/2.3.0\n","enisa_id":"EUVD-2026-41013\n","assigner":"GitHub_M","epss":0.97,"dataProcessed":"Nov 7, 2026, 7:21:40 AM","vulnerabilityProduct":[{"id":"0ebab99f-1df2-31cd-a133-4737970a1483","product":{"name":"module-auth","vendor":{"name":"antonio-castellon"}},"product_version":"\u003c 2.3.0"}],"vulnerabilityVendor":[{"id":"f10d7c11-608d-3c27-960c-c72147c380ac","vendor":{"name":"antonio-castellon"}}]}}],"enisaIdAdvisory":[]}