CVE-2026-40910

{
  "id": "CVE-2026-40910",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T21:16:45.157",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1."
    },
    {
      "lang": "es",
      "value": "frp es un proxy inverso rápido. Desde 0.43.0 hasta 0.68.0, frp contiene una omisión de autenticación en la ruta de enrutamiento de vhost HTTP cuando se usa routeByHTTPUser como parte del control de acceso. En solicitudes de estilo proxy, la lógica de enrutamiento usa el nombre de usuario de Proxy-Authorization para seleccionar el backend routeByHTTPUser, mientras que la verificación de control de acceso usa credenciales del encabezado Authorization regular. Como resultado, un atacante que puede alcanzar el punto de entrada del vhost HTTP y conoce o puede adivinar el valor protegido de routeByHTTPUser puede acceder a un backend protegido por httpUser / httpPassword incluso con una contraseña de Proxy-Authorization incorrecta. Este problema afecta a las implementaciones que usan explícitamente routeByHTTPUser. No afecta a los proxies HTTP ordinarios que no usan esta característica. Esta vulnerabilidad se corrige en 0.68.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "fatedier",
          "product": "frp",
          "versions": [
            {
              "version": "< 0.68.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-21T20:28:44.365794Z",
          "id": "CVE-2026-40910",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fatedier:frp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.43.0",
              "versionEndExcluding": "0.68.1",
              "matchCriteriaId": "2D911E2E-2DC1-4FC1-ABCE-0482EB5D8DD1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}