Executive brief
A reverse proxy forwards requests to a bundled administrative interface without applying its own authentication checks first. This interface manages the credential store that protects all other services in the deployment. If the third-party interface has weak authentication, an attacker could bypass the gateway entirely and compromise the entire credential management system.
Technical details
The vulnerability is an authentication bypass in a reverse proxy when a particular authentication mode is configured. The proxy forwards requests directly to a bundled third-party administrative interface without enforcing the gateway's own authentication requirements beforehand. Access control for the administrative interface—which manages the credential store securing all downstream services—is entirely delegated to the third-party interface's own login mechanism. Any authentication weakness in that interface would directly compromise the entire deployment's credential security posture. This creates a cascading authentication failure where an attacker exploiting the third-party interface's weakness gains full control of credentials protecting all protected services.
Timeline
- 2026-09-11: disclosed
- 2026-09-11: advisory