9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-0650

CVE-2026-0650: OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-0650

CVE-2026-0650:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openflagr/flagr	go	< 0.0.0-20251009103504-fe83dc87aa40	0.0.0-20251009103504-fe83dc87aa40

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the authentication middleware of OpenFlagr, specifically within the whitelist methods of the jwtAuth and basicAuth structs located in pkg/config/middleware.go. These methods are responsible for determining if an incoming HTTP request can bypass authentication based on its URL path. The flaw stemmed from the use of strings.HasPrefix for checking if a request path matched any of the configured whitelisted prefixes. This function performs a simple string comparison and does not account for path normalization. As a result, an attacker could craft a malicious URL containing path traversal elements (e.g., /whitelisted_prefix/../protected_endpoint). The strings.HasPrefix check would incorrectly identify the path as whitelisted, granting unauthorized access to protected API endpoints. The patch addresses this by introducing a new function, util.HasSafePrefix, which uses path.Clean to normalize the URL path before performing the prefix check. This ensures that path traversal sequences are resolved before the whitelist check is performed, effectively closing the authentication bypass vulnerability.

Vulnerable functions

jwtAuth.whitelist

pkg/config/middleware.go

The `whitelist` method on the `jwtAuth` struct was vulnerable to an authentication bypass. It used `strings.HasPrefix` to check if a request's URL path was on a whitelist of prefixes that do not require authentication. This function does not normalize URL paths, allowing an attacker to use path traversal sequences (e.g., `..`) to craft a URL that matches a whitelisted prefix but resolves to a protected endpoint. The patch replaces the unsafe check with a call to `util.HasSafePrefix`, which normalizes the path before comparison.

basicAuth.whitelist

pkg/config/middleware.go

The `whitelist` method on the `basicAuth` struct was vulnerable to an authentication bypass. It used `strings.HasPrefix` to check if a request's URL path was on a whitelist of prefixes that do not require authentication. This function does not normalize URL paths, allowing an attacker to use path traversal sequences (e.g., `..`) to craft a URL that matches a whitelisted prefix but resolves to a protected endpoint. The patch replaces the unsafe check with a call to `util.HasSafePrefix`, which normalizes the path before comparison.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.