EUVD-2026-24477Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-reachable (AV:N) with AC:H because the attacker must know the routeByHTTPUser username; PR:N since no credentials are required to attempt the bypass; C:H for full backend access, I:L for incidental request injection.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1.
AnalysisAI
Authentication bypass in frp (fast reverse proxy) versions 0.43.0 through 0.68.0 allows network-accessible attackers to reach backends protected by httpUser/httpPassword access controls without valid credentials, when the routeByHTTPUser routing feature is in use. The flaw stems from a credential-source mismatch in pkg/util/vhost/http.go: route selection reads the username from the Proxy-Authorization header, while the access control check validates against the separate Authorization header, enabling an attacker who knows the routeByHTTPUser username to bypass authentication entirely. A proof-of-concept has been confirmed by the reporter against official release binaries; no active exploitation is recorded in CISA KEV.
Technical ContextAI
frp (CPE: cpe:2.3:a:fatedier:frp) is an open-source Go-based reverse proxy designed for NAT traversal and service exposure. The vulnerability (CWE-287: Improper Authentication) is located in pkg/util/vhost/http.go, introduced by commit 4af85da0c2c6eb981142a8fdb44f885d26cb9d08, first shipped in v0.43.0. In proxy-style HTTP requests using an absolute URI, the injectRequestInfoToCtx() function extracts the username from the Proxy-Authorization header and stores it as the routing HTTPUser for routeByHTTPUser backend selection. However, the authentication check in ServeHTTP() independently calls req.BasicAuth(), which reads from the standard Authorization header. Because these two code paths consume different credential sources, an attacker can supply a known routeByHTTPUser username in Proxy-Authorization to trigger correct backend routing, while the Authorization-based credential check operates on a completely separate - and attacker-controlled - value, creating a logical authentication bypass.
RemediationAI
Upgrade frp to version 0.68.1, which resolves the credential-source mismatch by making proxy-mode authentication consistently derive credentials from Proxy-Authorization, aligning the authentication check with the routing logic. This fix is confirmed by the vendor via GHSA-pq96-pwvg-vrr9 (https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9). For deployments unable to upgrade immediately, the most effective workaround is to remove the combined use of routeByHTTPUser with httpUser/httpPassword - using either feature independently eliminates the vulnerable code path, though this may require redesigning access control. Alternatively, restricting access to the frp HTTP vhost entrypoint at the network layer (firewall rules, VPN-only access) reduces the pool of potential attackers who can reach the endpoint, but does not eliminate the underlying flaw. Note that disabling routeByHTTPUser entirely may affect multi-tenant routing behavior that deployments may depend on.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today