{"id":"CVE-2026-58399","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-58399","summary":"@acastellon/auth: Authentication bypass via spoofable headers in validateToken()","details":"@acastellon/auth v2.2.0 appears to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers.\n\nThe validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs.\n\nImpact:\nAn attacker may be able to access routes protected by validateToken() without a valid token. In deployments where downstream services trust auth-user or is-* headers, this may also lead to privilege escalation.\n\nAffected package:\n@acastellon/auth v2.2.0\n\nAffected code:\nauth.js, validateToken()\nThe issue is related to the service-brother bypass and getHostName() check.\n\nExample request:\n```\nGET /protected HTTP/1.1\nHost: <configured CNAME or hostname>\nauth-user: service-brother\nis-admin: true\n```\n\nExpected behavior:\nThe request should require a valid authentication token.\n\nActual behavior:\nThe middleware calls next() before token validation.\n\nFix implemented in v2.3.0+:\n\nRemoved the spoofable bypass.\nAlways sanitize incoming auth-user and is-* headers.\nAdded mTLS client certificate based service auth (with optional TRUSTED_MTLS_SERVICES allowlist).\nUpdated consumers (rest, graphql, dns-client) for mTLS support.\nUnit tests added for sanitization + mTLS path.","published":"2026-06-18T17:22:47Z","modified":"2026-07-01T14:45:10.017097364Z","cvss":null,"epss":{"score":0.00543,"percentile":0.43059,"asOf":"2026-08-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@acastellon/auth","fixedVersion":"2.3.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw"},{"type":"WEB","url":"https://github.com/antonio-castellon/module-auth/issues/6"},{"type":"PACKAGE","url":"https://github.com/antonio-castellon/module-auth"},{"type":"WEB","url":"https://www.npmjs.com/package/@acastellon/auth/v/2.3.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-01T14:45:10.017097364Z"}}