PT-2026-34174 · Frp · Frp

0Wnerdied · Published 2026-04-14 · Updated 2026-04-27 · CVE-2026-40910

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions frp versions 0.43.0 through 0.68.0

Description An authentication bypass exists in the HTTP vhost routing path when routeByHTTPUser is utilized for access control. In proxy-style requests, the routing logic selects the routeByHTTPUser backend using the username from the "Proxy-Authorization" header, whereas the access control check validates credentials from the standard "Authorization" header. Consequently, an attacker who can reach the HTTP vhost entrypoint and knows or guesses the protected routeByHTTPUser value can access a backend protected by httpUser and httpPassword, even if the "Proxy-Authorization" password is incorrect. This issue specifically affects deployments that explicitly use routeByHTTPUser and does not impact ordinary HTTP proxies.

Recommendations Update to version 0.68.1. As a temporary workaround, restrict or disable the use of the routeByHTTPUser feature.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-40910

GHSA-PQ96-PWVG-VRR9

Affected Products

Frp

References · 5

• 🔥 https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9 · Exploit
• https://osv.dev/vulnerability/GHSA-pq96-pwvg-vrr9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40910 · Security Note
• https://github.com/fatedier/frp · Note
• https://twitter.com/CVEnew/status/2048910147645497591 · Twitter Post