CVE-2026-0650CWE-306CWE-425

CVE-2026-0650

published January 7, 2026

CVSS
9.3
EPSS
2%
Percentile
74.4
In the wild
Unconfirmed
What it is

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.01519 · 74.4th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-425 · Direct Request ('Forced Browsing')
Published
2026-01-07T17:17Z
References (3)
https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass · [email protected]https://github.com/openflagr/flagr/releases/tag/1.1.19 · [email protected]https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization · [email protected]
EPSS history
Timeline
  • 07 JAN 04:29Z
    OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization
    cvelistv5