{"id":"CVE-2026-8890","summary":"code100x Mobile API Authentication Bypass via Header Spoofing","details":"code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header. The middleware in middleware.ts skips identity header generation when an Auth-Key header is present without validating its value, allowing attackers to inject a spoofed user identity header that the downstream route handler in the mobile courses endpoint accepts as trusted, granting unauthorized access to course data belonging to any enrolled user or administrator.","modified":"2026-10-08T02:49:44.178088003Z","published":"2026-05-26T18:23:13.098Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8890.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8890.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8890"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/code100x-mobile-api-authentication-bypass-via-header-spoofing"},{"type":"REPORT","url":"https://github.com/code100x/cms/issues/1924"},{"type":"REPORT","url":"https://github.com/code100x/cms/pull/1927"},{"type":"REPORT","url":"https://github.com/code100x/cms/pull/1927/changes/88c6c5e94e23da101235c4c7e9c7591ac1016549"},{"type":"REPORT","url":"https://github.com/code100x/cms/pull/1927/changes/90b489ee7c63c301107d6374d4b3f2b8e4060fe5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/code100x/cms","events":[{"introduced":"0"},{"fixed":"90b489ee7c63c301107d6374d4b3f2b8e4060fe5"},{"fixed":"88c6c5e94e23da101235c4c7e9c7591ac1016549"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8890.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}]}