{"id":"CVE-2026-58399","aliases":["GHSA-gfj5-979r-92pw"],"title":"@acastellon/auth: Authentication bypass via spoofable headers in validateToken()","summary":"@acastellon/auth: Authentication bypass via spoofable headers in validateToken()","severity":"critical","cwe":["CWE-290"],"vendor":"acastellon","product":"@acastellon/auth","ecosystem":"npm","affected":["@acastellon/auth < 2.3.0"],"patched":["@acastellon/auth 2.3.0"],"published":"2026-06-18","updated":"2026-07-01","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-gfj5-979r-92pw","references":[{"url":"https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw"},{"url":"https://github.com/antonio-castellon/module-auth/issues/6"},{"url":"https://www.npmjs.com/package/@acastellon/auth/v/2.3.0"},{"url":"https://github.com/advisories/GHSA-gfj5-979r-92pw"}],"tags":["ghsa","npm"],"epss":0.00973,"epssPercentile":0.60447,"ingestedAt":"2026-07-07T15:41:58.289Z","slug":"CVE-2026-58399","body":"## Overview\n\n@acastellon/auth v2.2.0 appears to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers.\n\nThe validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs.\n\nImpact:\nAn attacker may be able to access routes protected by validateToken() without a valid token. In deployments where downstream services trust auth-user or is-* headers, this may also lead to privilege escalation.\n\nAffected package:\n@acastellon/auth v2.2.0\n\nAffected code:\nauth.js, validateToken()\nThe issue is related to the service-brother bypass and getHostName() check.\n\nExample request:\n```\nGET /protected HTTP/1.1\nHost: <configured CNAME or hostname>\nauth-user: service-brother\nis-admin: true\n```\n\nExpected behavior:\nThe request should require a valid authentication token.\n\nActual behavior:\nThe middleware calls next() before token validation.\n\nFix implemented in v2.3.0+:\n\nRemoved the spoofable bypass.\nAlways sanitize incoming auth-user and is-* headers.\nAdded mTLS client certificate based service auth (with optional TRUSTED_MTLS_SERVICES allowlist).\nUpdated consumers (rest, graphql, dns-client) for mTLS support.\nUnit tests added for sanitization + mTLS path.\n\n## Affected packages\n\n- `@acastellon/auth < 2.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@acastellon/auth 2.3.0`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}