module-auth vulnerabilities

1 known vulnerability in module-auth from Antonio-castellon. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  module-auth: Improper Authentication

  CVE-2026-58399Jul 1, 2026Antonio-castellon

  @acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware conta