Skip to content
OpenAdvisories

Package · npm

@acastellon/auth

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 8.7
    CVE-2026-58399

    @acastellon/auth has an authentication bypass via spoofable headers in validateToken()

    @acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware cont…

    antonio-castellon module-auth @acastellon/auth npm