Executive brief
A vulnerability in the @acastellon/auth library allows unauthorized users to bypass security checks and access protected parts of an application. By sending specifically crafted web requests with fake identity headers, an attacker can trick the system into believing they are a trusted internal service. This could lead to unauthorized access to sensitive data or administrative functions without a valid login.
Technical details
An authentication bypass exists in the validateToken() middleware of @acastellon/auth due to an insecure service-to-service bypass logic. The middleware checks if the 'auth-user' header is set to 'service-brother' and if the 'Host' header matches the expected hostname; however, both of these values are client-controlled. A remote, unauthenticated attacker can spoof these headers to bypass JWT/OIDC validation entirely. This can lead to full access to protected routes and potential privilege escalation if downstream services trust the 'auth-user' or 'is-*' headers. The issue is fixed in version 2.3.0 by removing the header-based bypass and implementing mTLS for service authentication.
Affected products
- antonio-castellon @acastellon/auth < 2.3.0
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory: GitHub Advisory published
- 2026-06-18: patched: Fixed in version 2.3.0