Junglewise Threat Intelligence

CVE-2026-8890: code100x cms authentication bypass in Mobile API

CVE-2026-8890 · Severity: high · CVSS 8.2 · Published 2026-05-26

Executive brief

The code100x content management system contains a security flaw in its mobile application interface. This vulnerability allows an unauthorized person to pretend to be any other user, including administrators, by sending specially crafted network requests. An attacker could use this to gain full access to private course data and sensitive user information without needing a valid password.

Technical details

An authentication bypass exists in the code100x Mobile API due to improper header validation in 'middleware.ts'. The 'withMobileAuth' function incorrectly assumes that the presence of an 'Auth-Key' header—regardless of its value—is sufficient to skip standard identity generation. Consequently, the middleware fails to strip or overwrite the 'g' HTTP header if it is supplied by the client. A remote, unauthenticated attacker can provide a spoofed JSON payload in the 'g' header containing a target user's ID. The downstream route handler in the mobile courses endpoint ('/src/app/api/mobile/courses/[courseId]/route.ts') trusts this client-supplied header, allowing the attacker to access course data belonging to any user or administrator. A fix has been proposed in pull request #1927 to validate the 'Auth-Key' and strip the 'g' header from incoming requests.

Affected products

  • code100x cms commit 90b489e and earlier

Timeline

  • 2026-05-17: disclosed: Issue reported on GitHub
  • 2026-05-22: patched: Fix submitted via Pull Request #1927
  • 2026-05-26: advisory: NVD publication date

References