Executive brief
100xDevs CMS is a content management system for an online learning platform. A flaw in the mobile API authentication allows attackers to bypass login requirements by sending any value in an authentication header, enabling unauthorized access to course content and user data that should require a valid account.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the withMobileAuth middleware function within src/middleware.ts. The middleware grants access to protected /api/mobile routes based solely on the presence of an Auth-Key header, without validating its value against any server-side secret. Additionally, downstream handlers trust a client-supplied "g" header to identify the user, allowing attackers to forge arbitrary user identity. An unauthenticated attacker can reach protected endpoints including the search API by sending any arbitrary Auth-Key value and a forged user identity header, bypassing JWT verification entirely. No patch has been released as of the disclosure date.
Affected products
- code100x 100xDevs CMS 1.0 (2026-04-30)
Timeline
- 2026-04-30: disclosed: Vulnerability identified and verified
- 2026-08-06: advisory: CVE service request submitted
- 2026-08-07: other: Re-verified as still present and unpatched on main branch