Wheels Framework EUVD-2026-102605

No special configuration is required - any unauthenticated client can force the alternate context against default deployments of Wheels 4.0.6 through 4.1.2 by supplying an X-Wheels-Test-Context header, a WHEELS_TEST_CONTEXT cookie with any value, or a test-runner path segment anywhere in the URL including the query string. Limiting factors bound the real impact: the maintenance-mode bypass only matters when maintenance mode was enabled at runtime (not via static config), the duplicate rate-limit counters only matter where Wheels' in-memory rate limiting is relied upon, and the memory/startup side effects require repeated requests to be meaningful. No confidentiality or privilege gain is possible because the alternate application shares the same configuration, environment, datasource, and debug settings.

Signals point to a genuinely-easy-to-trigger but low-consequence issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is remotely reachable by any unauthenticated client with no user interaction and low complexity - simply attaching a header, cookie, or URL path - which is why the base score reaches 6.5. However, the impact metrics (C:N/I:L/A:L, S:U) and the vendor advisory text keep this firmly in medium territory: the description explicitly states 'this is not an authentication bypass or data/debug escalation,' and the alternate context inherits the SAME configuration, datasource, and debug settings, so no new data or privileges are exposed. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified - there is no public exploit identified at time of analysis. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' directly contradicts the CVE description, which says this is explicitly NOT an authentication bypass; treat that tag as mislabeled. Real-world priority is moderate-to-low - trivially triggerable but bounded to runtime maintenance-mode bypass, rate-limit counter resets, and extra memory/startup churn.

An unauthenticated attacker sends an ordinary HTTP request to a production Wheels 4.0.6-4.1.2 application but adds an X-Wheels-Test-Context header (or a WHEELS_TEST_CONTEXT cookie, or a test-runner path segment in the URL/query string) with any value, forcing the request into a parallel test application context. By repeating such requests the attacker triggers extra application-startup side effects and memory consumption, resets in-memory rate-limit counters, and reaches the app even when maintenance mode was enabled at runtime. No public exploit code has been identified at time of analysis.