Skip to content
OpenAdvisories

Package · Go

github.com/azukaar/cosmos-server

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-49446

    Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

    Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before rem…

    azukaar Cosmos-Server github.com/azukaar/cosmos-server Go
  • Medium 5.3
    CVE-2026-49447

    Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

    Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that su…

    azukaar Cosmos-Server github.com/azukaar/cosmos-server Go