# CVE-2026-73611: File Browser JWT expiration bypass in proxy authentication

Source: https://junglewise.ai/threats/cve-2026-73611-file-browser-jwt-expiration-bypass-in-proxy-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73611 · Severity: medium · CVSS 6.8 · Published 2026-08-13

File Browser is a web-based file manager used to browse and manage server files remotely. When configured with proxy authentication and a custom logout page, the application fails to validate JWT token expiration, allowing attackers who previously obtained a valid token to indefinitely access protected files and administrative settings—including reading sensitive data and renewing their access without re-authentication.

Technologies: [File Browser](https://junglewise.ai/threats/technologies/file-browser). Vendors: [File Browser](https://junglewise.ai/threats/vendors/file-browser).

## Quick answers

**Is CVE-2026-73611 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73611 being exploited in the wild.

**How severe is CVE-2026-73611?** Medium severity, with a CVSS score of 6.8, published 13 August 2026.

**Which products and versions are affected?** File Browser 2.50.0 through 2.63.21.

**Is there a fix for CVE-2026-73611?** A patch was published on 2026-07-27: Patched in v2.63.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73611 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73611?** Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass due to improper JWT expiration validation in the http/auth.go middleware. When proxy authentication is enabled with a non-default logout page, the renewableErr function treats expired JWTs as renewable without verifying that the proxy still asserts the same identity. An attacker with a previously valid (but now expired) token can send requests to protected routes and administrative endpoints; the withUser middleware loads the expired claims and continues, and the renewHandler endpoint issues fresh tokens. The flaw affects versions 2.50.0 through 2.63.21 and requires the attacker to possess a token issued before expiration; no proxy bypass or token forgery is necessary. The vulnerability was patched in v2.63.22 by adding a check that the proxy header identity matches the token claims before waiving expiration.

## Affected products

- File Browser File Browser 2.50.0 through 2.63.21

## Timeline

- 2026-07-27: disclosed: Fix commit published (72faf6d)
- 2026-07-27: patched: Patched in v2.63.22
- 2026-08-13: advisory: CVE-2026-73611 published

## References

- [https://github.com/filebrowser/filebrowser/commit/72faf6dd3c85628e332d3e567124b86708ce2695](https://github.com/filebrowser/filebrowser/commit/72faf6dd3c85628e332d3e567124b86708ce2695)
- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-v3jv-rmh2-635j](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-v3jv-rmh2-635j)

## Related threats

- [File Browser symlink alias path traversal bypass](https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass)
- [File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint)
- [File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion)
- [File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file)
- [File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive)