---
id: CVE-2026-0650
title: >-
  OpenFlagr versions prior to and including 1.1.18 contain an authentication
  bypass vulnerability in the HTTP middleware
summary: >-
  OpenFlagr versions prior to and including 1.1.18 contain an authentication
  bypass vulnerability in the HTTP middleware. Due to improper handling of path
  normalization in the whitelist logic, crafted requests can bypass
  authentication and…
severity: none
cwe:
  - CWE-306
  - CWE-425
published: '2026-01-07'
updated: '2026-07-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0650'
references:
  - url: >-
      https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openflagr/flagr/releases/tag/1.1.19'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
epss: 0.01316
epssPercentile: 0.69513
ingestedAt: '2026-07-15T13:44:03.778Z'
exploits:
  nuclei:
    - CVE-2026-0650
  checkedAt: '2026-09-23T07:13:45.079Z'
exploitAvailable: true
---

## Overview

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.