CVE-2026-8890 code100x Mobile API Authentication Bypass via Header Spoofing
Attackers can bypass authentication in the code100x Mobile API by spoofing headers to access unauthorized user and administrator course data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8890?
CVE-2026-8890 is a high-severity authentication bypass vulnerability in code100x, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header. The middleware in middleware.ts skips identity header generation when an Auth-Key header is present without validating its value, allowing attackers to inject a spoofed user identity header that the downstream route handler in the mobile courses endpoint accepts as trusted, granting unauthorized access to course data belonging to any enrolled user or administrator.
Weakness: CWE-639
Which versions are affected by CVE-2026-8890?
How do I fix CVE-2026-8890?
No fix has been published for CVE-2026-8890 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-8890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8890 exists.
Sources
Also known as GHSA-qggg-4j5m-mx55.