CVE-2026-58399 @acastellon/auth has an authentication bypass via spoofable headers in validateToken()
An unauthenticated attacker can bypass token validation in @acastellon/auth by spoofing auth-user and Host headers, gaining unauthorized access to protected microservices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58399?
CVE-2026-58399 is a high-severity authentication bypass vulnerability in antonio-castellon module-auth, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs. A fix has been implemented in v2.3.0.
Weakness: CWE-287
Which versions are affected by CVE-2026-58399?
2 open source packages ship an affected version, including @acastellon/auth.
| Package | Affected | Fixed in |
|---|---|---|
@acastellon/auth npm | All versions | 2.3.0 |
@acastellon/auth npm | All versions | 2.3.0 |
How do I fix CVE-2026-58399?
Upgrade @acastellon/auth to 2.3.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-58399 being exploited?
There is no known exploitation of CVE-2026-58399 in the wild and no public exploit code.
Sources
Also known as GHSA-gfj5-979r-92pw.