Executive brief
Caddy is a web server platform used to host websites and manage traffic. A security flaw in how it handles user identity information allows attackers to bypass authentication checks when Caddy is used with PHP applications. By sending specially crafted web requests, an attacker can trick the backend application into believing they have higher privileges or are a different user, potentially leading to unauthorized access to sensitive data or administrative functions.
Technical details
A vulnerability exists in Caddy's 'forward_auth' module when used in conjunction with 'php_fastcgi'. The 'copy_headers' directive attempts to sanitize the request by deleting client-supplied headers that match trusted identity headers (e.g., 'Remote-User') before replacing them with values from an auth gateway. However, Caddy's FastCGI implementation normalizes headers by replacing hyphens with underscores (e.g., 'Remote_User' becomes 'HTTP_REMOTE_USER'). An attacker can provide a header using underscores that bypasses the initial deletion step but is interpreted by the PHP backend as the trusted identity variable. This allows for header injection or overriding of group/user identity. The issue is fixed in version 2.11.4.
Affected products
- Caddyserver Caddy < 2.11.4
Timeline
- 2026-06-08: advisory: GitHub advisory published by maintainers
- 2026-06-23: disclosed: CVE published to NVD