PT-2026-54912 · Npm · @Acastellon/Auth

Hackchang · Published 2026-06-18 · Updated 2026-07-02 · CVE-2026-58399

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @acastellon/auth versions prior to 2.3.0

Description An authentication bypass exists in the validateToken() middleware. The issue stems from improper trust in spoofable request headers and flawed request flow control, which allows the next() function to be called before authentication checks are completed. Specifically, a service-to-service bypass is triggered when the auth-user header is set to service-brother and the Host header starts with the value returned by getHostName(). Since both the auth-user and Host headers are controlled by the client, a remote unauthenticated attacker can craft these headers to skip legacy, JWT, or OIDC token validation, potentially leading to unauthorized access, privilege escalation, and lateral movement.

Recommendations Update to version 2.3.0.

Fix

Improper Authentication

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-287

CWE-290

Related Identifiers

CVE-2026-58399

GHSA-GFJ5-979R-92PW

Affected Products

@Acastellon/Auth

References · 9

• https://osv.dev/vulnerability/GHSA-gfj5-979r-92pw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-58399 · Security Note
• https://twitter.com/UpwindMDR/status/2072364955978932423 · Twitter Post
• https://github.com/antonio-castellon/module-auth/issues/6 · Note
• https://t.me/cveNotify/185390 · Telegram Post
• https://npmjs.com/package/@acastellon/auth/v/2.3.0 · Note
• https://t.me/cveNotify/184956 · Telegram Post
• https://github.com/antonio-castellon/module-auth · Note
• https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw · Note