CVE-2026-74864 Authentication Bypass in sogo_yhn
Attackers can bypass authentication by injecting a specific HTTP header, gaining unauthorized access to any user account, including privileged ones.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74864?
CVE-2026-74864 is a critical authentication bypass vulnerability in YunoHost-Apps sogo_yhn, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password.
This issue was fixed in version 5.8.0~ynh9.
Weakness: CWE-639
Which versions are affected by CVE-2026-74864?
How do I fix CVE-2026-74864?
No fix has been published for CVE-2026-74864 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-74864 being exploited?
There is no known exploitation of CVE-2026-74864 in the wild and no public exploit code.
Sources
Also known as GHSA-fxx9-8vhm-fwhc.