CVE-2026-49446: Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Pr

Executive brief

Cosmos-Server, a self-hosting platform and reverse proxy, contains a flaw that allows users with basic access to bypass security controls. By sending specially crafted network requests through the Constellation VPN tunnel, an authorized non-admin user can impersonate an administrator. This allows them to access protected applications and perform administrative actions without providing a password or multi-factor authentication.

Technical details

An authentication bypass exists in the `tokenMiddleware` component of Cosmos-Server. The middleware contains a logic error where requests originating from the Constellation tunnel bypass standard JWT and MFA checks if certain headers are present. Because the middleware fails to strip user-supplied `x-cosmos-user` and `x-cosmos-role` headers before processing this bypass branch, an attacker with a valid Constellation device API key can smuggle these headers to proxied backends. This allows the attacker to impersonate any user, including administrators, on any backend application that relies on Cosmos's forward-auth headers for identity. The vulnerability is fixed in version 0.22.19.

Affected products

• azukaar Cosmos-Server <= 0.22.18

Timeline

• 2026-07-28: advisory: GHSA-2rx5-2g7j-2659 published
• 2026-07-28: patched: Fixed in version 0.22.19

References

• https://api.github.com/users/Dredsen
• https://github.com/Dredsen
• https://api.github.com/users/Dredsen/gists%7B/gist_id%7D
• https://api.github.com/users/Dredsen/repos
• https://avatars.githubusercontent.com/u/24421368?v=4
• https://api.github.com/users/Dredsen/events%7B/privacy%7D