CVE-2026-108548Published
AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108548 · Microsoft / collected KEV context
cve-program · CVE-2026-108548
- https://github.com/iflytek/astron-rpa/issues/886
- https://github.com/iflytek/astron-rpa
- https://github.com/iflytek/astron-rpa/blob/v1.1.6/docker/volumes/nginx/lua/auth_handler.lua#L21-L35
- https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/ai-service/app/dependencies/__init__.py#L10-L24
- https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-authentication-bypass-via-arbitrary-bearer-token
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.