CVE-2026-0650

OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization

State: Published
Severity: 9.3 Critical
Published: Jan 7, 2026
Updated: Oct 8, 2026
Reserved: Jan 6, 2026

Description

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-425 Direct Request ('Forced Browsing')

Affected Products

Product	Versions
FlagrOpenFlagr	1.1.18 and earlierAffected

References

https://github.com/openflagr/flagr/releases/tag/1.1.19release-notespatch
https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypasstechnical-descriptionexploit
https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalizationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.