Executive brief
OpenFlagr is an open-source service used by businesses to manage feature flags and A/B testing, controlling which features are visible to users. A security flaw in its authentication system allows unauthorized individuals to bypass login requirements and gain full control over the service. An attacker could use this to change application settings, disable features, or steal sensitive configuration data and user databases.
Technical details
An authentication bypass exists in OpenFlagr's Basic and JWT auth middleware (pkg/config/middleware.go). The vulnerability stems from the `whitelist()` method, which uses `strings.HasPrefix()` to compare the request path against whitelisted routes (like /api/v1/health) without performing path normalization. By using path traversal sequences (e.g., /api/v1/health/../export/sqlite), a remote, unauthenticated attacker can reach protected endpoints. This allows for full CRUD operations on flags, segments, and constraints, as well as database exports. The issue is resolved in version 1.1.19 by fixing the path check logic.
Affected products
- OpenFlagr Flagr <= 1.1.18
Timeline
- 2026-01-03: disclosed: Initial researcher blog post published
- 2026-01-07: advisory: CVE published to NVD
- 2026-01-09: patched: Version 1.1.19 released with fix