Skip to content
OpenAdvisories

Product · l3montree-dev

devguard

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-42300

    DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header

    DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session c…

    l3montree-dev devguard github.com/l3montree-dev/devguard Go