-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of authentication provider nesting in Ktor's DSL configuration. The pull request #3092 specifically addresses 'fix nesting of Authentication providers' by modifying how authentication configurations are applied in nested routes. The root cause was in the authentication installation mechanism (Authentication.install) that didn't properly scope providers when routes were nested, potentially causing the framework to select a parent route's authentication provider instead of the child route's intended one. This matches the CWE-287 description of improper authentication due to flawed provider selection logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.ktor:ktor | maven | < 2.1.0 | 2.1.0 |
Ongoing coverage of React2Shell