CVE-2026-3839CWE-22

Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability

High · published March 13, 2026

CVSS v3.0
7.3
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the auth-request.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in authentications. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28912.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00879 · 58.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-13T20:38Z
EPSS history
Timeline
  • 13 MAR 20:38Z
    Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability
    cvelistv5