EUVD-2026-63649Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote client spoofs a forwarded header with no authentication (PR:N, AV:N, AC:L); impact is impersonation affecting confidentiality and integrity (C:H/I:H) with no availability effect, though real impact depends on backend header trust.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.
AnalysisAI
Authentication bypass in Centrifugo real-time messaging server before 6.9.0 lets a remote client spoof trusted proxy headers by populating the client-controlled protocol.ConnectRequest.headers map, which Centrifugo copies and forwards to backend proxies as trusted headers or gRPC metadata. When a backend relies on a header such as x-trusted-user for authentication or authorization, an attacker can impersonate arbitrary users across connect, refresh, subscribe, publish, and RPC proxy calls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that Centrifugo is deployed with a proxy (HTTP via internal/proxy/http.go, gRPC via internal/proxy/grpc.go, or unidirectional gRPC via internal/unigrpc/grpc.go) and that the backend relies on a client-forwardable header/metadata value - the advisory names x-trusted-user - for authentication or authorization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) reflects a network-reachable, low-complexity, unauthenticated spoofing primitive with high confidentiality and integrity impact and no availability impact - consistent with an auth-bypass that lets a client assume another identity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Centrifugo 6.9.0, which fixes the header-spoofing behavior (release https://github.com/centrifugal/centrifugo/releases/tag/v6.9.0; fix in PR https://github.com/centrifugal/centrifugo/pull/1182 and commit 84d38cea1dd2efa24375a148817a974c8727f4b0; advisory https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Centrifugo deployments below version 6.9.0 and identify which authentication or authorization decisions depend on proxy headers (x-trusted-user, x-user-id, etc.). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Centrifugo
View allSame weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today