{"id":"EUVD-2026-78588","enisaUuid":"977ab004-c9ae-3066-b7c4-ad7d9fc37734","description":"Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.","datePublished":"Sep 15, 2026, 2:31:24 PM","dateUpdated":"Sep 15, 2026, 2:50:54 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659\nhttps://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf\nhttps://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19\n","aliases":"CVE-2026-49446\nGHSA-2rx5-2g7j-2659\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"76ae858b-2bb6-3911-9657-9794424525b3","product":{"name":"Cosmos-Server","vendor":{"name":"azukaar"}},"product_version":"\u003c 0.22.19"}],"enisaIdVendor":[{"id":"51b68afe-a45a-3561-8901-c7cc886d260c","vendor":{"name":"azukaar"}}],"enisaIdVulnerability":[{"id":"ced4b983-94ef-3760-a187-2b14ed4a4722","vulnerability":{"id":"CVE-2026-49446","description":"Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.","datePublished":"Sep 15, 2026, 2:31:24 PM","dateUpdated":"Sep 15, 2026, 2:50:54 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659\nhttps://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf\nhttps://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19\n","enisa_id":"EUVD-2026-78588\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"bd883738-daa8-3e07-85b7-1feadcfcbf97","product":{"name":"Cosmos-Server","vendor":{"name":"azukaar"}},"product_version":"\u003c 0.22.19"}],"vulnerabilityVendor":[{"id":"e670e8c2-0988-31c0-b6f8-7f993e6a6f31","vendor":{"name":"azukaar"}}]}},{"id":"f1cdf35e-3f28-389d-926e-958e78c5cc82","vulnerability":{"id":"GHSA-2rx5-2g7j-2659","description":"Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel","datePublished":"Jul 28, 2026, 8:44:33 PM","dateUpdated":"Jul 28, 2026, 8:44:33 PM","baseScore":0.0,"references":"https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659\nhttps://github.com/azukaar/Cosmos-Server\nhttps://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19\n","enisa_id":"EUVD-2026-78588\n","aliases":"GHSA-2rx5-2g7j-2659\nCVE-2026-49446\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}