CVE-2025-66200: Apache HTTP Server Auth Bypass Flaw

CVE-2025-66200 Overview

CVE-2025-66200 is an authentication bypass vulnerability in the Apache HTTP Server affecting the interaction between mod_userdir and suexec. Users who can leverage the RequestHeader directive within an .htaccess file can cause certain Common Gateway Interface (CGI) scripts to execute under an unexpected user identifier. The flaw impacts Apache HTTP Server versions 2.4.7 through 2.4.65, and the project has released version 2.4.66 to address it. The issue is classified under [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

Critical Impact
Local users with AllowOverride FileInfo privileges can execute CGI scripts under a userid they should not control, undermining the isolation provided by suexec in shared hosting environments.

Affected Products

Apache HTTP Server 2.4.7 through 2.4.65
Deployments using mod_userdir combined with suexec
Shared hosting configurations that allow AllowOverride FileInfo in .htaccess

Discovery Timeline

2025-12-05 - CVE-2025-66200 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66200

Vulnerability Analysis

The vulnerability stems from how Apache HTTP Server processes the RequestHeader directive when it is declared inside a user-controlled .htaccess file. In multi-tenant environments, mod_userdir maps requests to per-user directories, and suexec enforces that CGI scripts execute under the corresponding user account. When AllowOverride FileInfo is enabled, users can define RequestHeader directives that manipulate headers reaching downstream CGI handlers. This manipulation can cause suexec to select an unintended target userid, breaking the trust boundary between tenants.

The result is an authentication bypass through an alternate channel [CWE-288]. A user with legitimate access to their own .htaccess file can influence which system account executes CGI code, subverting the per-user isolation that suexec is designed to enforce.

Root Cause

The root cause is insufficient sanitization of .htaccess-supplied RequestHeader directives before their values propagate into the CGI execution path handled by suexec. Apache treats these headers as trusted input when constructing the CGI environment, allowing user-controlled data to influence privilege-relevant decisions.

Attack Vector

Exploitation requires the attacker to have low-privileged access sufficient to create or modify an .htaccess file in a directory where AllowOverride FileInfo is permitted. The attacker inserts a crafted RequestHeader directive and issues an HTTP request that triggers a CGI script through mod_userdir. The suexec wrapper then executes the script under a userid different from the expected owner. No user interaction is required beyond the attacker-controlled request. Refer to the Apache HTTP Server Vulnerabilities advisory for the authoritative technical description.

Detection Methods for CVE-2025-66200

Indicators of Compromise

CGI script executions where the effective userid in suexec logs does not match the owner of the user directory serving the request.
Unexpected RequestHeader directives appearing in per-user .htaccess files under paths handled by mod_userdir.
Anomalous process ancestry showing CGI processes spawned under userids that do not correspond to the requesting ~user path.

Detection Strategies

Audit .htaccess files across user home directories for RequestHeader directives, and flag any additions that occurred after CVE publication.
Correlate Apache access logs with suexec logs (/var/log/apache2/suexec.log or /var/log/httpd/suexec.log) to identify mismatches between requested user paths and executed userids.
Query the Apache HTTP Server version reported by servers under management and compare against the fixed release 2.4.66.

Monitoring Recommendations

Enable and centrally collect suexec logs to preserve evidence of userid switching during CGI execution.
Monitor file integrity on all .htaccess files within UserDir-enabled trees to detect unauthorized modifications.
Alert on Apache configurations that combine mod_userdir, suexec, and AllowOverride FileInfo on hosts still running vulnerable versions.

How to Mitigate CVE-2025-66200

Immediate Actions Required

Upgrade Apache HTTP Server to version 2.4.66 on all systems running versions 2.4.7 through 2.4.65.
Inventory shared hosting servers that enable mod_userdir with suexec and prioritize them for patching.
Review existing .htaccess files under user directories for RequestHeader directives placed prior to upgrade.

Patch Information

The Apache HTTP Server project has released version 2.4.66 to fix this issue. Consult the Apache HTTP Server Vulnerabilities page for the official fix notes and the OpenWall OSS-Security Post for the public disclosure thread.

Workarounds

Remove FileInfo from AllowOverride in directories exposed via mod_userdir until the patch is applied.
Disable mod_userdir entirely on servers where per-user directories are not required.
Restrict .htaccess write access on shared hosts and require administrator review for RequestHeader changes.

bash

# Configuration example: restrict AllowOverride for UserDir until patched
<Directory /home/*/public_html>
    AllowOverride AuthConfig Limit Options=Indexes,MultiViews
    # FileInfo intentionally omitted to block RequestHeader in .htaccess
    Options -ExecCGI
</Directory>