Centrifugo EUVD-2026-63649

Exploitation requires that Centrifugo is deployed with a proxy (HTTP via internal/proxy/http.go, gRPC via internal/proxy/grpc.go, or unidirectional gRPC via internal/unigrpc/grpc.go) and that the backend relies on a client-forwardable header/metadata value - the advisory names x-trusted-user - for authentication or authorization. The exact prerequisite is a backend that trusts an emulated/forwarded header allowlisted by Centrifugo; where that header governs identity, a remote client can spoof it for connect, refresh, subscribe, publish, and RPC calls. Limiting factors: deployments that do not use proxy mode, do not forward headers, or authenticate via signed JWTs rather than trusted headers are not exploitable. The unidirectional gRPC transport is the most exposed because no transport-level HTTP header can override the client-supplied emulated value.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) reflects a network-reachable, low-complexity, unauthenticated spoofing primitive with high confidentiality and integrity impact and no availability impact - consistent with an auth-bypass that lets a client assume another identity. The real-world severity is strongly conditional: it only matters when the deployment uses Centrifugo proxy/emulated-header mode AND the backend actually trusts a forwarded header (e.g. x-trusted-user) for authn/authz. In that configuration the impact is severe and effectively unauthenticated; in deployments not using header-based backend trust, exposure is minimal. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input - the priority rests on configuration exposure rather than on observed exploitation. This is a genuine high-priority issue for affected configurations rather than a purely theoretical high-CVSS finding.

An attacker opens a normal client connection to a Centrifugo server that runs in proxy mode where the backend authenticates users by a forwarded x-trusted-user header. The attacker sets that header value in the ConnectRequest emulated-headers map to a victim or privileged username; Centrifugo forwards it to the backend as a trusted header, and the backend authorizes the attacker as that identity for connect/subscribe/publish/RPC. No public POC is identified in the provided data, but the low attack complexity and network vector make exploitation straightforward against a vulnerable configuration.