Skip to main content

Otp CVE-2026-28808

| EUVDEUVD-2026-19602 HIGH
Incorrect Authorization (CWE-863)
2026-04-07 EEF
Authentication Bypass Otp
8.3
CVSS 4.0 · Vendor: EEF
Share

Severity by source

Vendor (EEF) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat
7.4 HIGH
qualitative

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Re-analysis Queued
Apr 23, 2026 - 17:57 vuln.today
cvss_changed
EUVD ID Assigned
Apr 07, 2026 - 12:45 euvd
EUVD-2026-19602
Analysis Generated
Apr 07, 2026 - 12:45 vuln.today
Patch released
Apr 07, 2026 - 12:45 nvd
Patch available
CVE Published
Apr 07, 2026 - 12:28 nvd
HIGH 8.3

DescriptionCVE.org

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6.

AnalysisAI

Authorization bypass in Erlang OTP's inets HTTP server allows unanauthenticated remote attackers to execute CGI scripts protected by directory-level access controls. The vulnerability stems from a path mismatch where mod_auth validates access against DocumentRoot-relative paths while mod_cgi executes scripts at ScriptAlias-resolved paths outside DocumentRoot. With CVSS 8.3 (AV:N/AC:L/PR:N), the attack requires no authentication and low complexity but depends on specific ScriptAlias configuration

Technical ContextAI

Erlang OTP's inets application provides an HTTP server implementation with modular request handling. The vulnerability occurs in the interaction between three modules: mod_alias (URL-to-filesystem mapping via ScriptAlias), mod_auth (directory-based access control), and mod_cgi (CGI script execution). When ScriptAlias maps a URL prefix to a directory outside the configured DocumentRoot, mod_auth performs authorization checks against the original URL path relative to DocumentRoot, while mod_cgi resolves and executes the script at the physical filesystem location specified by ScriptAlias. This architectural flaw (CWE-863: Incorrect Authorization) creates a path traversal condition where authorization controls are evaluated against one path but execution occurs at another, effectively bypassing directory-based authentication requirements for CGI endpoints. The vulnerability affects the core HTTP server functionality used in Erlang/OTP applications that expose CGI capabilities through the inets httpd server.

RemediationAI

Upgrade Erlang OTP to patched versions: 28.4.2 or later for OTP 28.x series, 27.3.4.10 or later for OTP 27.x series, or 26.2.5.19 or later for OTP 26.x series. Patches are available through the official Erlang OTP GitHub repository with fix commits 8fc71ac6af4fbcc54103bec2983ef22e82942688 and 9dfa0c51eac97866078e808dec2183cb7871ff7c. Vendor security advisory is published at https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f with full technical details at https://cna.erlef.org/cves/CVE-2026-28808.html. For environments unable to immediately upgrade, implement compensating controls by reviewing ScriptAlias configurations to ensure CGI directories requiring authentication are not mapped outside DocumentRoot, or migrate authentication enforcement to application-level mechanisms within CGI scripts rather than relying solely on mod_auth directory rules. Organizations should audit existing inets httpd deployments for ScriptAlias usage patterns that create authorization bypass conditions before patching.

More in Otp

View all
CVE-2022-24584 MEDIUM POC
6.5 May 11

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
CVE-2026-49759 HIGH
8.8 Jun 10

Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by

CVE-2026-55950 HIGH
8.7 Jul 02

Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
CVE-2026-58227 HIGH
8.7 Jul 27

Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
CVE-2026-59250 HIGH
8.3 Jul 27

We need to output a JSON object based on the CVE-2026-59250 data. We must synthesize from multiple sources: description,
CVE-2026-55952 HIGH
8.2 Jul 02

Denial of service in the Erlang/OTP ssl application (OTP 22.2 through 29.0.3, and the 28.5.x/27.3.x maintenance branches
CVE-2026-32144 HIGH
7.6 Apr 07

Erlang OTP public_key module (versions 1.16 through 1.20.3 and 1.17.1.2) fails to cryptographically verify OCSP responde
CVE-2026-48860 HIGH
7.5 Jun 10

Authentication bypass in Erlang/OTP's TLS distribution module (inet_tls_dist) lets any attacker holding a TLS certificat
CVE-2026-48856 HIGH
7.1 Jun 10

Credential leakage in Erlang/OTP's inets httpc client (versions 17.0 through 29.0.2, 28.5.0.2, and 27.3.4.13) allows att
CVE-2026-23941 HIGH
7.0 Mar 13

A critical HTTP Request Smuggling vulnerability exists in Erlang OTP's inets httpd module that allows attackers to desyn
CVE-2026-23943 MEDIUM
6.9 Mar 13

A remote code execution vulnerability (CVSS 6.9) that allows denial of service. Remediation should follow standard vulne

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-28808 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy