Which versions of @acastellon/auth are affected by CVE-2026-58399?

@acastellon/auth npm package (versions before 2.3.0) contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate trusted internal services by spoofing request…. A patch is available.

How to fix or mitigate CVE-2026-58399?

24 hours: Inventory all applications and services using @acastellon/auth npm package and document versions in use; assess production exposure. 7 days: Deploy compensating controls including WAF rules to validate and sanitize auth-user and Host headers; implement application-level header validation at entry points. 30 days: Monitor vendor advisory for patch availability targeting version 2.3.0 or later; apply immediately upon release; conduct service-to-service authentication policy review.

@acastellon/auth CVE-2026-58399

Q: What is the CVSS score of CVE-2026-58399?

CVE-2026-58399 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41013 HIGH

Improper Authentication (CWE-287)

2026-07-01 GitHub_M

GHSA-gfj5-979r-92pw

Authentication Bypass Module Auth

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Fully remote header spoofing with no auth or interaction gives AV:N/AC:L/PR:N/UI:N; the core impact is forged identity/trust so I:H, with C:N/A:N per the reported scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 16:01 EUVD

Analysis Generated

Jul 01, 2026 - 14:52 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on @acastellon/auth (2 direct, 1 indirect)

Ecosystem-wide dependent count for version 2.3.0.

DescriptionCVE.org

@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs. A fix has been implemented in v2.3.0.

AnalysisAI

Authentication bypass in @acastellon/auth (npm package, aka antonio-castellon/module-auth) before 2.3.0 lets a remote unauthenticated attacker impersonate a trusted internal service by sending spoofed 'auth-user' and 'Host' request headers. The validateToken() middleware short-circuits its own token check when auth-user equals 'service-brother' and the Host header starts with the configured hostname - both fully client-controllable - so an attacker skips legacy/JWT/OIDC validation entirely. No public exploit identified at time of analysis, but the flaw is trivially reproducible from the advisory and carries CVSS 4.0 8.7 (high).

Technical ContextAI

The affected component is a Node.js/Express-style authentication middleware distributed on npm as @acastellon/auth for gating microservice-to-microservice calls. The root cause maps to CWE-287 (Improper Authentication): a service-to-service 'trust' fast-path treats two attacker-influenceable HTTP request headers as identity proof. Specifically, req.get('host').startsWith(getHostName()) combined with an auth-user header value of 'service-brother' is used as a substitute for cryptographic token validation. Because Express reads the Host header and arbitrary custom headers directly from the client request, this check validates nothing an attacker cannot forge. The single affected CPE is cpe:2.3:a:antonio-castellon:module-auth:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: 2.3.0 - upgrade the dependency to @acastellon/auth 2.3.0 or later (npm install @acastellon/auth@^2.3.0, then rebuild and redeploy affected microservices) as the primary fix, per advisory GHSA-gfj5-979r-92pw (https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw). If you cannot upgrade immediately, strip or reject the client-supplied auth-user header at the ingress/reverse proxy so external callers can never set auth-user: service-brother, and normalize/validate the Host header at the proxy against an allowlist of expected hostnames; the trade-off is that any legitimate internal service that genuinely relied on the header-based service-brother fast path will lose it and must move to real token authentication. As defense-in-depth, base the service-to-service trust boundary on network segmentation/mTLS rather than on HTTP headers. Verify the fix by confirming that a request with a forged auth-user: service-brother header and a matching Host is rejected after patching.