GHSA-gfj5-979r-92pwPublished
@acastellon/auth has an authentication bypass via spoofable headers in validateToken()
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-58399 · Microsoft / collected KEV context
cve-program · CVE-2026-58399
- https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw
- https://github.com/antonio-castellon/module-auth/issues/6
- https://www.npmjs.com/package/@acastellon/auth/v/2.3.0
euvd · EUVD-2026-41013
- https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw
- https://github.com/antonio-castellon/module-auth/issues/6
- https://www.npmjs.com/package/@acastellon/auth/v/2.3.0
nvd · CVE-2026-58399
- https://github.com/antonio-castellon/module-auth/issues/6
- https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw
- https://www.npmjs.com/package/@acastellon/auth/v/2.3.0
osv · GHSA-gfj5-979r-92pw
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.