Executive brief
DevGuard, a software supply chain vulnerability management platform, contains a security flaw that allows unauthorized individuals to bypass authentication. By sending a specially crafted network request, an attacker can impersonate any user, including administrators. This could lead to a total takeover of an organization's security resources and sensitive data.
Technical details
An authentication bypass exists in DevGuard's SessionMiddleware due to the improper handling of the 'X-Admin-Token' HTTP request header. When a Kratos session cookie is absent, the middleware incorrectly treats the raw string value of this client-supplied header as a valid authenticated userID. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can exploit this to issue requests with that user's privileges. If the target is an organization owner or admin, the attacker gains full control over the organization's resources. The issue is fixed in version 1.2.2 by removing the vulnerable admin token implementation.
Affected products
- l3montree-dev devguard < 1.2.2
Timeline
- 2026-04-20: patched: Fix committed to repository
- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD