CVE-2026-90579
cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 13, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 12, 2026
Description
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custom_auth_handler.py. The manipulation of the argument user_id leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Cheshire Cat AIcheshire-cat-ai |
|
References
- VDB-403164 | cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authenticationvdb-entrytechnical-description
- VDB-403164 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-90579 | CVE Analysis and Reportthird-party-advisory
- Submit #913219 | https://github.com/cheshire-cat-ai core v1.9.2 Missing Authenticationthird-party-advisory
- https://github.com/cheshire-cat-ai/core/issues/1137exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.