@fastify/auth EUVD-2026-80788

Requires an application running @fastify/auth 5.0.0 through 5.1.0 that composes strategies using the relation 'or' option together with the run 'all' option where at least one entry is a nested array acting as an AND group (or the mirror configuration: top-level relation 'and' with a nested 'or' group). The attacker must possess a valid credential that satisfies the last member of the AND group (e.g. a valid API key) but not the earlier stricter check (e.g. administrator status); the group's outcome then collapses to its last check and authorizes the request. Limiting factors: PR:L means a legitimate low-privilege credential is required (not fully unauthenticated), and exploitation is confined to this non-default, specific strategy-composition pattern - applications that omit run 'all', order the stricter check last, or use explicit top-level 'and' composition are not affected. Fixed by upgrading to 5.1.1 or later.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) is well-calibrated for an authorization-logic flaw: exploitation is network-reachable with low complexity, but PR:L is decisive - the attacker must already hold a valid low-privilege credential (e.g. a valid API key) to reach the vulnerable AND-group evaluation, so this is a privilege-escalation/authorization bypass, not a true pre-auth authentication bypass. C:H/I:H with A:N is appropriate because gaining admin-equivalent authorization exposes read and write over protected resources without a direct availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. This is a genuine priority for the specific subset of applications that use the vulnerable composition pattern, but the elevated 8.1 should be read through two limiters: the attacker needs a legitimate credential, and the app must be configured with the exact vulnerable strategy composition. No SSVC decision data was supplied. Note the 'Authentication Bypass' tag versus CWE-285 (Improper Authorization) - the flaw bypasses authorization decisions for an already-authenticated principal, not authentication itself.

An attacker who legitimately holds a low-privilege credential such as a valid API key sends a normal authenticated request to a route guarded by @fastify/auth composed with relation 'or' plus run 'all' where one entry is a nested AND group (e.g. valid-API-key AND is-administrator). Because an earlier failing check in the group is silently dropped and only the last check determines the group's result, the attacker satisfies just the final member and is authorized as if the stricter check passed, reaching admin-only functionality. No public exploit code was identified, but the misordering is trivially triggerable once the vulnerable composition is known.