Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@acastellon/auth

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3npmAmendedPublished

    @acastellon/auth: Authentication bypass via spoofable headers in validateToken()

    CVE-2026-58399 · GHSA-gfj5-979r-92pw

    Affected
    • npm @acastellon/auth < 2.3.0
    Fixed in
    2.3.0· Vendor fix available
    Issue
    @acastellon/auth v2.2.0 appears to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs. Impact: An attacker may be able to access routes protected by validateToken() without a valid token. In deployments where downstream services trust auth-user or is- headers, this may also lead to privilege escalation. Affected package: @acastellon/auth v2.2.0 Affected code: auth.js, validateToken() The issue is related to the service-brother bypass and getHostName()…

    Recommended action: Upgrade to 2.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →