# CVE-2026-45567: Roxy-WI authentication bypass via URL substring manipulation

Source: https://junglewise.ai/threats/cve-2026-45567-roxy-wi-authentication-bypass-via-url-substring-manipulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45567 · Severity: high · CVSS 8.3 · Published 2026-06-10

Roxy-WI, a management interface for web servers like Nginx and HAProxy, contains a security flaw that allows unauthorized users to bypass login requirements. By simply adding a specific keyword to a web address, an attacker can access internal functions without a password. This could lead to the theft of license keys, unauthorized use of paid AI services (GPT) at the owner's expense, and potential access to sensitive server management features.

Technologies: [Roxy-WI](https://junglewise.ai/threats/technologies/roxy-wi). Vendors: [Roxy-WI](https://junglewise.ai/threats/vendors/roxy-wi).

## Quick answers

**Is CVE-2026-45567 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45567 being exploited in the wild.

**How severe is CVE-2026-45567?** High severity, with a CVSS score of 8.3, published 10 June 2026.

**Which products and versions are affected?** Roxy-WI <= 8.2.6.4.

**Is there a fix for CVE-2026-45567?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45567 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45567?** Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass exists in Roxy-WI's global 'before_request' hook in 'app/login.py'. The application incorrectly skips authentication if the substring 'api' is present anywhere in the request URL, including query parameters (e.g., '/overview/?api=1'). Additionally, the '/api/gpt' endpoint was registered directly on the main application object rather than the API blueprint, causing it to lack both the global authentication check and the blueprint's specific security decorators. Attackers can exploit this to reach sensitive handlers without credentials, potentially leaking license keys or exhausting GPT quotas. As of the advisory date, no patches are available.

## Affected products

- Roxy-WI Roxy-WI <= 8.2.6.4

## Timeline

- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE-2026-45567 published to NVD

## References

- [https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-4fcm-qgg8-w2vf](https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-4fcm-qgg8-w2vf)

## Related threats

- [Roxy-WI path traversal in configuration management](https://junglewise.ai/threats/cve-2026-45569-roxy-wi-path-traversal-in-configuration-management)
- [Roxy-WI open redirect in login flow via userinfo syntax bypass](https://junglewise.ai/threats/cve-2026-45566-roxy-wi-open-redirect-in-login-flow-via-userinfo-syntax-bypass)
- [Roxy-WI input validation bypass in EscapedString validator](https://junglewise.ai/threats/cve-2026-45565-roxy-wi-input-validation-bypass-in-escapedstring-validator)
- [Roxy-WI command injection in config versions save route](https://junglewise.ai/threats/cve-2026-45564-roxy-wi-command-injection-in-config-versions-save-route)
- [Roxy-WI authorization bypass in history endpoint](https://junglewise.ai/threats/cve-2026-45563-roxy-wi-authorization-bypass-in-history-endpoint)