CVE-2026-19863 An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.
Unauthenticated attackers can bypass authentication on protected resources if the request path contains the configured login path as a substring.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19863?
CVE-2026-19863 is a critical authentication bypass vulnerability, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.
This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED.
Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.
Which versions are affected by CVE-2026-19863?
How do I fix CVE-2026-19863?
No fix has been published for CVE-2026-19863 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-19863 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19863 exists.
Sources
Also known as GHSA-6m7j-pjmp-crgq.