CVE-2026-0650: OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization
Vulnerability summary
CVE-2026-0650 is a critical (CVSS 9.3) vulnerability in openflagr flagr. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.6% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 07-01-2026PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
1.52%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.52% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (dreyand.rs)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionalityThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-425Direct RequestThe web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/openflagr1 product
- flagr< 0.0.0-20251009103504-fe83dc87aa40
Openflagr1 product
- flagr≤ 1.1.18
2 vendors · 2 products
References
7 links- dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypassTechnical DescriptionExploitWEB
- github.com/openflagr/flagrPACKAGE