Executive brief
OTP's inets httpd server contains an authentication bypass flaw in the mod_auth module when using dets or mnesia backends with multiple protected directories. Users authenticated for one directory are automatically accepted for all other protected directories on the same server, allowing unauthorized access to restricted content.
Technical details
The mod_auth module in OTP's inets httpd server improperly manages user/group namespaces when configured with dets or mnesia authentication backends and multiple directory configuration blocks. The vulnerability causes all directory blocks to collapse into a single shared namespace, rather than maintaining separate access control per directory. An authenticated user requires valid credentials for at least one protected directory (PR:L), but network access (AV:N) is required. An attacker with credentials for any protected directory gains unauthorized access to all protected directories on the same server instance. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+, corresponding to inets 9.3.2.7, 9.6.2.3, and 9.7.2 respectively.
Affected products
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Patches released in OTP 27.3.4.17, 28.5.0.6, 29.0.6 and corresponding inets versions