CVE-2026-8890

216.73.217.64

· Published 26/05/2026 19:16 · Modified 26/05/2026 20:16

Labels: CVE-2026-8890 2026-05-26 CVE-2026-8890 CWE-639 [email protected]

Essential information

Published: 26/05/2026 19:16
Modified: 26/05/2026 20:16
Author: —
Creator: —
CVSS: 8.8 HIGH (v3) 8.8 HIGH (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header. The middleware in middleware.ts skips identity header generation when an Auth-Key header is present without validating its value, allowing attackers to inject a spoofed user identity header that the downstream route handler in the mobile courses endpoint accepts as trusted, granting unauthorized access to course data belonging to any enrolled user or administrator.

NVD status

Status: Deferred — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
code100x / code100x	`cpe:2.3:a:code100x:code100x::::::::`