Executive brief
A security vulnerability in the @acastellon/auth library, which manages authentication for microservices, allows unauthorized users to bypass security checks. By sending specially crafted network requests with fake identity headers, an attacker can gain access to protected areas of an application without a valid login. This could lead to unauthorized data access or the ability for an attacker to perform administrative actions.
Technical details
An authentication bypass exists in the validateToken() middleware of @acastellon/auth versions prior to 2.3.0. The vulnerability stems from a service-to-service bypass logic that trusts the 'auth-user' and 'Host' HTTP headers. Specifically, if the 'auth-user' header is set to 'service-brother' and the 'Host' header matches the expected hostname, the middleware calls next() before performing JWT or OIDC validation. A remote, unauthenticated attacker can spoof these headers to bypass authentication and potentially escalate privileges by injecting 'is-admin' headers that downstream services might trust. The issue is resolved in version 2.3.0 by removing the header-based bypass and implementing mTLS for service-to-service authentication.
Affected products
- antonio-castellon @acastellon/auth < 2.3.0
Timeline
- 2026-06-18: disclosed: Vulnerability reported and advisory drafted on GitHub
- 2026-07-01: advisory: NVD published the CVE record
- 2026-07-01: patched: Fix confirmed available in version 2.3.0