{"id":"GHSA-gfj5-979r-92pw","summary":"@acastellon/auth: Authentication bypass via spoofable headers in validateToken()","details":"@acastellon/auth v2.2.0 appears to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers.\n\nThe validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs.\n\nImpact:\nAn attacker may be able to access routes protected by validateToken() without a valid token. In deployments where downstream services trust auth-user or is-* headers, this may also lead to privilege escalation.\n\nAffected package:\n@acastellon/auth v2.2.0\n\nAffected code:\nauth.js, validateToken()\nThe issue is related to the service-brother bypass and getHostName() check.\n\nExample request:\n```\nGET /protected HTTP/1.1\nHost: \u003cconfigured CNAME or hostname\u003e\nauth-user: service-brother\nis-admin: true\n```\n\nExpected behavior:\nThe request should require a valid authentication token.\n\nActual behavior:\nThe middleware calls next() before token validation.\n\nFix implemented in v2.3.0+:\n\nRemoved the spoofable bypass.\nAlways sanitize incoming auth-user and is-* headers.\nAdded mTLS client certificate based service auth (with optional TRUSTED_MTLS_SERVICES allowlist).\nUpdated consumers (rest, graphql, dns-client) for mTLS support.\nUnit tests added for sanitization + mTLS path.","aliases":["CVE-2026-58399"],"modified":"2026-09-10T03:51:08.661430056Z","published":"2026-06-18T17:22:47Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-290"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-06-18T17:22:47Z"},"references":[{"type":"WEB","url":"https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw"},{"type":"WEB","url":"https://github.com/antonio-castellon/module-auth/issues/6"},{"type":"PACKAGE","url":"https://github.com/antonio-castellon/module-auth"},{"type":"WEB","url":"https://www.npmjs.com/package/@acastellon/auth/v/2.3.0"}],"affected":[{"package":{"name":"@acastellon/auth","ecosystem":"npm","purl":"pkg:npm/%40acastellon/auth"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-gfj5-979r-92pw/GHSA-gfj5-979r-92pw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}