CVE-2026-91143
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass c
CVSS
7.2
Alto
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 14 sept 2026 · Última mod.: 14 sept 2026 · CWE-288
Sin historial EPSS suficiente todavía.
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
- github.comhttps://github.com/geo-chen/oss/blob/main/goproxy.md
- github.comhttps://github.com/snail007/goproxy
- github.comhttps://github.com/snail007/goproxy/blob/v15.3/services/http.go
- github.comhttps://github.com/snail007/goproxy/blob/v15.3/utils/structs.go
- www.vulncheck.comhttps://www.vulncheck.com/advisories/goproxy-through-15.3-authentication-bypass-via-connect
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-88260—9.9%
——3Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion.
This issue affects Zenius EMS 8.0: through OAM (Build 109).4dCVE-2026-81906—27.0%
——8Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully authenticated for the callback response, with the login recorded and login events dispatched. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.4dCVE-2026-817967.3 ALT13.3%
——4Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions.5dCVE-2026-817876.5 MED16.3%
——5Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.5dCVE-2026-817837.1 ALT14.1%
——4Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.5dCVE-2026-888618.3 ALT21.5%
——6Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor that has not been used for the session: the Edge JWT middleware (foundJWT() in supabase/functions/_backend/utils/hono_middleware.ts) accepts the JWT without validating its assurance level, and the direct RBAC path (checkPermission()/checkPermissionPg() in supabase/functions/_backend/utils/rbac.ts calling public.rbac_check_permission_direct()) authorizes by user ID without passing or checking the session aal, unlike the public.verify_mfa() control which correctly requires aal2. An attacker who knows only the victim's password can therefore authenticate, mint a persistent app-scoped app_admin API key that remains valid after the aal1 session is logged out, and perform privileged operations such as modifying production OTA channel configurations (validated by changing a public production channel from bundle 1.0.0 to 1.0.1), defeating the protection provided by MFA.5d