CVE-2026-40910

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40910", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-15T16:37:22.767Z", "datePublished": "2026-04-21T20:09:00.893Z", "dateUpdated": "2026-04-21T20:28:48.579Z"}, "containers": {"cna": {"title": "frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9"}], "affected": [{"vendor": "fatedier", "product": "frp", "versions": [{"version": "< 0.68.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T20:09:00.893Z"}, "descriptions": [{"lang": "en", "value": "frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1."}], "source": {"advisory": "GHSA-pq96-pwvg-vrr9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-21T20:28:44.365794Z", "id": "CVE-2026-40910", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T20:28:48.579Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40910", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T20:28:44.365794Z"}}}], "references": [{"url": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T20:28:37.740Z"}}], "cna": {"title": "frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control", "source": {"advisory": "GHSA-pq96-pwvg-vrr9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "fatedier", "product": "frp", "versions": [{"status": "affected", "version": "< 0.68.1"}]}], "references": [{"url": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9", "name": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T20:09:00.893Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40910", "state": "PUBLISHED", "dateUpdated": "2026-04-21T20:28:48.579Z", "dateReserved": "2026-04-15T16:37:22.767Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T20:09:00.893Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "frp", "vendor": "fatedier", "versions": [{"status": "affected", "version": "< 0.68.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fatedier:frp:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D911E2E-2DC1-4FC1-ABCE-0482EB5D8DD1", "versionEndExcluding": "0.68.1", "versionStartIncluding": "0.43.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1."}, {"lang": "es", "value": "frp es un proxy inverso r\u00e1pido. Desde 0.43.0 hasta 0.68.0, frp contiene una omisi\u00f3n de autenticaci\u00f3n en la ruta de enrutamiento de vhost HTTP cuando se usa routeByHTTPUser como parte del control de acceso. En solicitudes de estilo proxy, la l\u00f3gica de enrutamiento usa el nombre de usuario de Proxy-Authorization para seleccionar el backend routeByHTTPUser, mientras que la verificaci\u00f3n de control de acceso usa credenciales del encabezado Authorization regular. Como resultado, un atacante que puede alcanzar el punto de entrada del vhost HTTP y conoce o puede adivinar el valor protegido de routeByHTTPUser puede acceder a un backend protegido por httpUser / httpPassword incluso con una contrase\u00f1a de Proxy-Authorization incorrecta. Este problema afecta a las implementaciones que usan expl\u00edcitamente routeByHTTPUser. No afecta a los proxies HTTP ordinarios que no usan esta caracter\u00edstica. Esta vulnerabilidad se corrige en 0.68.1."}], "id": "CVE-2026-40910", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40910", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-21T20:28:44.365794Z", "version": "2.0.3"}}]}, "published": "2026-04-21T21:16:45.157", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.68.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "frp", "source": "cna", "vendor": "fatedier"}, "product": "frp", "vendor": "fatedier"}], "created": "2026-04-22T06:45:10.877821+00:00", "updated": "2026-05-01T05:45:10.275204+00:00", "vendors": ["fatedier", "fatedier$PRODUCT$frp"]}