by Kastro
Paper/Archive/CVE-2026-0650

CVE-2026-0650

OpenFlagr Flagr — OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization

EPSS 2%public exploitCVSS 9.3
critical.is priorityof 100
53
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 74.5.745 × 2014.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.

Affected

ProductAffectedFixed inSource
Flagr≤ 1.1.18–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

patchgithub.com/openflagr/flagr/releases/tag/1.1.19exploitdreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypasswriteupvulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization