Bifrost · Bifrost · CVE-2022-39267
**Name of the Vulnerable Software and Affected Versions**
Bifrost versions prior to 1.8.8-release
**Description**
The issue is related to authentication bypass in the admin and monitor user groups. This can be achieved by deleting the `X-Requested-With: XMLHttpRequest` field in the request header. There are no known details about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.
**Recommendations**
For versions prior to 1.8.8-release, upgrade to version 1.8.8-release or later to resolve the issue.
As a temporary workaround, consider restricting access to the admin and monitor user groups until a patch is applied.
Avoid modifying the `X-Requested-With` header in requests to minimize the risk of exploitation.