{"id":"EUVD-2026-41013","revision":"41667b57022a4dbb8a9ac104f5cf971e","records":[{"revision":"41667b57022a4dbb8a9ac104f5cf971e","observedAt":"2026-11-05T12:40:44.056+00:00","statement":{"source":"euvd","id":"EUVD-2026-41013","aliases":["CVE-2026-58399"],"title":"@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateTo…","description":"@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs. A fix has been implemented in v2.3.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw","https://github.com/antonio-castellon/module-auth/issues/6","https://www.npmjs.com/package/@acastellon/auth/v/2.3.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41013","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 1, 2026, 2:25:44 PM","dateUpdated":"Jul 2, 2026, 2:26:00 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-41013","identifiers":["EUVD-2026-41013","CVE-2026-58399"]},"retained":false,"historicalAffected":[]}],"coverage":[]}