Executive brief
Roxy-WI, a management interface for web servers like Nginx and HAProxy, contains a security flaw that allows unauthorized users to bypass login requirements. By simply adding a specific keyword to a web address, an attacker can access internal functions without a password. This could lead to the theft of license keys, unauthorized use of paid AI services (GPT) at the owner's expense, and potential access to sensitive server management features.
Technical details
An authentication bypass exists in Roxy-WI's global 'before_request' hook in 'app/login.py'. The application incorrectly skips authentication if the substring 'api' is present anywhere in the request URL, including query parameters (e.g., '/overview/?api=1'). Additionally, the '/api/gpt' endpoint was registered directly on the main application object rather than the API blueprint, causing it to lack both the global authentication check and the blueprint's specific security decorators. Attackers can exploit this to reach sensitive handlers without credentials, potentially leaking license keys or exhausting GPT quotas. As of the advisory date, no patches are available.
Affected products
- Roxy-WI Roxy-WI <= 8.2.6.4
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE-2026-45567 published to NVD