PT-2026-43378 · Code100X · Code100X

Shravan Manne + 1 · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-8890

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions code100x (affected versions not specified)

Description An authentication bypass exists in the Mobile API. Unauthenticated attackers can impersonate arbitrary users by providing a crafted JSON payload in the 'g' HTTP header. This occurs because the middleware in middleware.ts skips identity header generation when an Auth-Key header is present without validating its value. Consequently, attackers can inject a spoofed user identity header that the downstream route handler in the mobile courses endpoint trusts, granting unauthorized access to course data of administrators or enrolled users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-8890

Affected Products

Code100X

References · 7

• 🔥 https://github.com/code100x/cms/issues/1924 · Exploit
• 🔥 https://github.com/code100x/cms/pull/1927 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8890 · Security Note
• https://github.com/code100x/cms/pull/1927/changes/88c6c5e94e23da101235c4c7e9c7591ac1016549 · Note
• https://github.com/code100x/cms/pull/1927/changes/90b489ee7c63c301107d6374d4b3f2b8e4060fe5 · Note
• https://t.me/CVEtracker/55013 · Telegram Post
• https://vulncheck.com/advisories/code100x-mobile-api-authentication-bypass-via-header-spoofing · Note