PT-2026-50161 · Caddy · Caddy
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Caddy versions prior to 2.11.4
Description
An issue exists where
forward auth copy headers deletes client-supplied identity headers before copying trusted values from an authentication gateway. However, when requests are processed via php fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing hyphens (-) with underscores ( ). This allows a remote client to send an underscore alias (e.g., Remote Groups instead of Remote-Groups) that bypasses the deletion step but results in the same PHP/FastCGI variable (e.g., HTTP REMOTE GROUPS). Consequently, a remote client can inject or override identity or group headers trusted by PHP/FastCGI applications behind Caddy, potentially leading to group/role injection or user impersonation.Recommendations
Update to version 2.11.4.
As a temporary workaround, restrict the use of the
php fastcgi module or the forward auth copy headers feature for identity headers until the update is applied.Exploit
Fix
Improper Authentication
Authentication Bypass by Spoofing
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Caddy