PT-2026-63978 · Undefined · Undefined
CVE-2026-91204
·
Published
2026-07-23
·
Updated
2026-07-23
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
A critical architectural flaw affecting reverse proxies and API gateways has been disclosed over the last 24 hours. A severe Zero-Day vulnerability dubbed "AuthUnbound" (tracked as CVE-2026-91204, CVSS 9.8) has emerged, impacting Nginx / Nginx Plus configurations utilizing the auth request module for centralized authentication.
When your perimeter edge proxy fails to correctly isolate asynchronous subrequest headers, your entire microservice authorization layer collapses without firing a single alert.
Technical Breakdown of AuthUnbound:
• The Root Cause: The flaw stems from an unsafe header-inheritance and socket-reuse mechanism within Nginx when handling HTTP/2 and HTTP/3 multiplexed streams during subrequest processing (auth request directive).
• The Exploitation Vector: A remote attacker sends a specifically malformed HTTP request carrying injected X-Forwarded-User or mutated Authorization subrequest headers.
• The Impact: The API gateway misinterprets the cached subrequest authentication state, validating the connection as authenticated. The attacker successfully bypasses external identity verification and gains direct, unauthenticated access to downstream internal APIs and protected enterprise microservices.
Strategic Takeaway for Infrastructure & Security Architects: Centralizing authentication at the reverse proxy level is an industry best practice, but edge proxies cannot be treated as infallible. Failing to re-validate tokens or sanitize subrequest headers at the downstream service level breaks Zero-Trust principles.
Immediate Remediation Requirements:
-
Apply Hotfix Patches: Immediately update Nginx / Nginx Plus instances to patched versions 1.26.3, 1.27.2+, or update custom OIDC modules.
-
Sanitize Subrequest Headers: Explicitly force proxy set header overrides inside auth request location blocks to clear untrusted incoming client headers before forwarding requests.
-
Audit WAF & Access Logs: Query WAF and Nginx access logs for anomalous HTTP status 200 responses on protected API routes preceded by mismatched or duplicated authorization headers over the last 48 hours.
How resilient is your Zero-Trust API gateway when subrequest protocol multiplexing introduces context desynchronization? Let's discuss in the comments.
[#Cybersecurity](https://www.linkedin.com/search/results/all/?keywords=%23cybersecurity&origin=HASH TAG FROM FEED) [#Nginx](https://www.linkedin.com/search/results/all/?keywords=%23nginx&origin=HASH TAG FROM FEED) [#APIGateway](https://www.linkedin.com/search/results/all/?keywords=%23apigateway&origin=HASH TAG FROM FEED) [#CloudSecurity](https://www.linkedin.com/search/results/all/?keywords=%23cloudsecurity&origin=HASH TAG FROM FEED) [#DevSecOps](https://www.linkedin.com/search/results/all/?keywords=%23devsecops&origin=HASH TAG FROM FEED) [#ZeroTrust](https://www.linkedin.com/search/results/all/?keywords=%23zerotrust&origin=HASH TAG FROM FEED) [#VulnerabilityManagement](https://www.linkedin.com/search/results/all/?keywords=%23vulnerabilitymanagement&origin=HASH TAG FROM FEED) [#SOC](https://www.linkedin.com/search/results/all/?keywords=%23soc&origin=HASH TAG FROM FEED) [#InfoSec](https://www.linkedin.com/search/results/all/?keywords=%23infosec&origin=HASH TAG FROM FEED) [#CVE202691204](https://www.linkedin.com/search/results/all/?keywords=%23cve202691204&origin=HASH TAG FROM FEED)
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined