GHSA-GFJ5-979R-92PW
Vulnerability from github – Published: 2026-06-18 17:22 – Updated: 2026-07-01 14:30@acastellon/auth v2.2.0 appears to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers.
The validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs.
Impact: An attacker may be able to access routes protected by validateToken() without a valid token. In deployments where downstream services trust auth-user or is-* headers, this may also lead to privilege escalation.
Affected package: @acastellon/auth v2.2.0
Affected code: auth.js, validateToken() The issue is related to the service-brother bypass and getHostName() check.
Example request:
GET /protected HTTP/1.1
Host: <configured CNAME or hostname>
auth-user: service-brother
is-admin: true
Expected behavior: The request should require a valid authentication token.
Actual behavior: The middleware calls next() before token validation.
Fix implemented in v2.3.0+:
Removed the spoofable bypass. Always sanitize incoming auth-user and is-* headers. Added mTLS client certificate based service auth (with optional TRUSTED_MTLS_SERVICES allowlist). Updated consumers (rest, graphql, dns-client) for mTLS support. Unit tests added for sanitization + mTLS path.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@acastellon/auth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-58399"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-18T17:22:47Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "@acastellon/auth v2.2.0 appears to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers.\n\nThe validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get(\u0027host\u0027).startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs.\n\nImpact:\nAn attacker may be able to access routes protected by validateToken() without a valid token. In deployments where downstream services trust auth-user or is-* headers, this may also lead to privilege escalation.\n\nAffected package:\n@acastellon/auth v2.2.0\n\nAffected code:\nauth.js, validateToken()\nThe issue is related to the service-brother bypass and getHostName() check.\n\nExample request:\n```\nGET /protected HTTP/1.1\nHost: \u003cconfigured CNAME or hostname\u003e\nauth-user: service-brother\nis-admin: true\n```\n\nExpected behavior:\nThe request should require a valid authentication token.\n\nActual behavior:\nThe middleware calls next() before token validation.\n\nFix implemented in v2.3.0+:\n\nRemoved the spoofable bypass.\nAlways sanitize incoming auth-user and is-* headers.\nAdded mTLS client certificate based service auth (with optional TRUSTED_MTLS_SERVICES allowlist).\nUpdated consumers (rest, graphql, dns-client) for mTLS support.\nUnit tests added for sanitization + mTLS path.",
"id": "GHSA-gfj5-979r-92pw",
"modified": "2026-07-01T14:30:32Z",
"published": "2026-06-18T17:22:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw"
},
{
"type": "WEB",
"url": "https://github.com/antonio-castellon/module-auth/issues/6"
},
{
"type": "PACKAGE",
"url": "https://github.com/antonio-castellon/module-auth"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/@acastellon/auth/v/2.3.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@acastellon/auth: Authentication bypass via spoofable headers in validateToken()"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.