CVE-2026-108548 AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
Unauthenticated attackers can bypass authentication in AstronRPA by sending arbitrary Bearer tokens to access protected APIs and impersonate users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108548?
CVE-2026-108548 is a medium-severity authentication bypass vulnerability in iflytek astron-rpa, published on 10 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.
Weakness: CWE-287
Which versions are affected by CVE-2026-108548?
How do I fix CVE-2026-108548?
No fix has been published for CVE-2026-108548 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-108548 being exploited?
There is no known exploitation of CVE-2026-108548 in the wild and no public exploit code.
Sources
Also known as GHSA-fh8f-pxvw-9f29.