Skip to main content

Otp CVE-2026-28808

| EUVDEUVD-2026-19602 HIGH
Incorrect Authorization (CWE-863)
2026-04-07 EEF
Authentication Bypass Otp Erlang
8.3
CVSS 4.0 · Vendor: EEF
Share

Severity by source

Vendor (EEF) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat
7.4 HIGH
qualitative

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Re-analysis Queued
Apr 23, 2026 - 17:57 vuln.today
cvss_changed
EUVD ID Assigned
Apr 07, 2026 - 12:45 euvd
EUVD-2026-19602
Analysis Generated
Apr 07, 2026 - 12:45 vuln.today
Patch released
Apr 07, 2026 - 12:45 nvd
Patch available
CVE Published
Apr 07, 2026 - 12:28 nvd
HIGH 8.3

DescriptionCVE.org

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6.

AnalysisAI

Authorization bypass in Erlang OTP's inets HTTP server allows unanauthenticated remote attackers to execute CGI scripts protected by directory-level access controls. The vulnerability stems from a path mismatch where mod_auth validates access against DocumentRoot-relative paths while mod_cgi executes scripts at ScriptAlias-resolved paths outside DocumentRoot. With CVSS 8.3 (AV:N/AC:L/PR:N), the attack requires no authentication and low complexity but depends on specific ScriptAlias configuration

Technical ContextAI

Erlang OTP's inets application provides an HTTP server implementation with modular request handling. The vulnerability occurs in the interaction between three modules: mod_alias (URL-to-filesystem mapping via ScriptAlias), mod_auth (directory-based access control), and mod_cgi (CGI script execution). When ScriptAlias maps a URL prefix to a directory outside the configured DocumentRoot, mod_auth performs authorization checks against the original URL path relative to DocumentRoot, while mod_cgi resolves and executes the script at the physical filesystem location specified by ScriptAlias. This architectural flaw (CWE-863: Incorrect Authorization) creates a path traversal condition where authorization controls are evaluated against one path but execution occurs at another, effectively bypassing directory-based authentication requirements for CGI endpoints. The vulnerability affects the core HTTP server functionality used in Erlang/OTP applications that expose CGI capabilities through the inets httpd server.

RemediationAI

Upgrade Erlang OTP to patched versions: 28.4.2 or later for OTP 28.x series, 27.3.4.10 or later for OTP 27.x series, or 26.2.5.19 or later for OTP 26.x series. Patches are available through the official Erlang OTP GitHub repository with fix commits 8fc71ac6af4fbcc54103bec2983ef22e82942688 and 9dfa0c51eac97866078e808dec2183cb7871ff7c. Vendor security advisory is published at https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f with full technical details at https://cna.erlef.org/cves/CVE-2026-28808.html. For environments unable to immediately upgrade, implement compensating controls by reviewing ScriptAlias configurations to ensure CGI directories requiring authentication are not mapped outside DocumentRoot, or migrate authentication enforcement to application-level mechanisms within CGI scripts rather than relying solely on mod_auth directory rules. Organizations should audit existing inets httpd deployments for ScriptAlias usage patterns that create authorization bypass conditions before patching.

More in Otp

View all
CVE-2022-24584 MEDIUM POC
6.5 May 11

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
CVE-2026-89422 CRITICAL
9.3 Sep 22

Erlang/OTP's ssl application in affected releases (OTP 22.2 through the fixed 27.3.4.18, 28.5.0.7 and 29.1.1) will compl
CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
CVE-2026-49759 HIGH
8.8 Jun 10

Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by

CVE-2026-70399 HIGH
8.7 Sep 01

Unauthenticated denial of service in Erlang/OTP's inets httpd allows any remote attacker to exhaust a server's process p
CVE-2026-55950 HIGH
8.7 Jul 02

Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
CVE-2026-71380 HIGH
8.7 Sep 01

Erlang/OTP's inets HTTP server (httpd) is vulnerable to a slow-body resource exhaustion attack exploitable by unauthenti
CVE-2026-58227 HIGH
8.7 Jul 27

Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
CVE-2026-74835 HIGH
8.7 Sep 01

Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when process
CVE-2026-59250 HIGH
8.3 Jul 27

Remote code execution and denial of service are possible against Erlang/OTP nodes that run the megaco application with t
CVE-2026-73276 HIGH
8.3 Sep 01

Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29
CVE-2026-66357 HIGH
8.3 Sep 01

HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arb

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-71362 CRITICAL POC
9.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-28808 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy