Skip to content
OpenAdvisories

Product · antonio-castellon

module-auth

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.7
    CVE-2026-58399

    @acastellon/auth has an authentication bypass via spoofable headers in validateToken()

    @acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware cont…

    antonio-castellon module-auth @acastellon/auth npm