EUVD-2026-78166
GHSA-pvfx-f5gx-wj35
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No auth or config prerequisite; scope changes as proxy relays to subsequent systems; no direct impact on proxy host itself.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
AnalysisAI
HTTP CONNECT tunnel authentication bypass in goproxy through v15.3 permits unauthenticated remote clients to establish arbitrary TCP tunnels through a proxy that has basic authentication configured, completely nullifying the access control mechanism. Attackers send CONNECT requests without an Authorization header and the proxy accepts them unconditionally, enabling relay of arbitrary TCP traffic to otherwise-restricted destinations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires goproxy version 15.3 or earlier deployed with HTTP basic authentication enabled and the proxy's listening port reachable from the attacker's network position. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with SC:L/SI:L/SA:N and a score of 6.9 accurately frames the threat: network-reachable with no prerequisites, but impact is limited to downstream systems reachable through the proxy rather than the proxy host itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today