http4k EUVD-2026-87855

Exploitable ONLY when http4k reverseProxy() or reverseProxyRouting() is deployed as a public-facing INBOUND HTTP handler AND configured with two or more virtual hosts AND the application relies on that vhost routing to enforce authorization. This is explicitly NOT the documented intent of these functions (intended use is outbound service dispatch and test-time fake-backend composition, where the Host value is trusted/application-set and is unaffected). The flaw is the default Contains (substring) Host-header matcher - a Host header merely containing a configured vhost name (e.g. Host: admin.evil.com for a vhost 'admin') is routed to that vhost. Limiting factors: requires the specific inbound multi-vhost deployment pattern (captured as AT:P), affects only versions < 6.49.0.0 / < 5.42.0.0 / < 4.51.0.0, and mitigable without upgrade by wrapping with an exact host-allow-list filter.

This is a genuine but tightly-scoped authorization-bypass issue, not a high-severity emergency. The vendor CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N with only subsequent-system SC:L/SI:L impact) already reflects a limited, conditional flaw: the AT:P (Attack Requirements: Present) metric is the key signal - exploitation depends on a specific, non-default deployment (reverseProxy()/reverseProxyRouting() used as a public-facing INBOUND handler with 2+ vhosts and routing-based authorization). The vendor's own advisory stresses this is NOT the documented/intended use of these functions (intended use is outbound dispatch and test composition, where Host is set by the trusted calling app). No EPSS score, no CISA KEV listing, and no public POC are provided in the input, so per precision rules this is 'no public exploit identified at time of analysis' - though the advisory describes the trivial exploit mechanics (Host: admin.evil.com hitting a vhost named 'admin'). The CVSS 4.0 vector is internally consistent with the description (network vector, no privileges, no user interaction, impact realized on a downstream/subsequent vhost rather than the proxy itself). Bottom line: real for the narrow population that deployed reverseProxy() inbound for multi-tenant authz, low relevance for everyone else. Priority is LOW-to-MEDIUM.

An organization deploys http4k's reverseProxy() as a public internet-facing gateway routing to virtual hosts named e.g. 'admin' and 'public', relying on that routing to keep the admin vhost internal. Because matching is substring-based by default, a remote unauthenticated attacker sends Host: admin.evil.com (or any value containing 'admin') and is routed straight to the admin vhost, bypassing the routing-based authorization boundary. No public POC is provided, but the advisory documents the exact trivial payload.