CVE-2026-11345: linqi Authentication Bypass Vulnerability

CVE-2026-11345 Overview

CVE-2026-11345 is an improper authentication vulnerability [CWE-287] in the /api/Cdn/GetFile endpoint of linqi. The flaw resides in the ValidateAnonFileAccess function, which incorrectly grants access when an AnonFile query parameter containing exactly 256 characters is supplied. Unauthenticated, remote attackers can bypass the intended authorization check without credentials or user interaction. The exposed resources are limited to minified JavaScript and CSS files that contain no sensitive data and are already publicly accessible through a standard content delivery network (CDN).

Critical Impact
Authentication bypass exposes only static front-end assets already served publicly via CDN, resulting in negligible confidentiality impact.

Affected Products

linqi platform — /api/Cdn/GetFile endpoint
ValidateAnonFileAccess authorization function
Specific affected versions: Not Available

Discovery Timeline

2026-06-05 - CVE-2026-11345 published to the National Vulnerability Database (NVD)
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-11345

Vulnerability Analysis

The vulnerability is an authentication bypass classified under [CWE-287] (Improper Authentication). The /api/Cdn/GetFile endpoint relies on the ValidateAnonFileAccess function to determine whether anonymous callers may retrieve a requested file. The function contains flawed validation logic that approves requests when the AnonFile query parameter is exactly 256 characters in length. Attackers do not need credentials, privileges, or user interaction to trigger the condition.

Vendor analysis confirms the practical impact is minimal. The endpoint only serves minified JavaScript and CSS assets that are simultaneously distributed through a public CDN. Confidentiality, integrity, and availability of application data are not affected by exploitation.

Root Cause

The root cause is improper authorization logic in ValidateAnonFileAccess. The function uses the length of the AnonFile query parameter as part of its access decision rather than validating a cryptographic token or signed value. A specific length (256 characters) short-circuits the validation and returns a permissive result, regardless of the parameter contents.

Attack Vector

Exploitation requires a single HTTP request to the /api/Cdn/GetFile endpoint with the AnonFile query parameter set to any 256-character string. The request originates from the network and requires no authentication or user interaction. Successful requests return the same static front-end resources that the application already publishes through its CDN.

No verified exploit code is available. See the Linqi Security Advisory for the vendor's technical description.

Detection Methods for CVE-2026-11345

Indicators of Compromise

HTTP GET requests to /api/Cdn/GetFile containing an AnonFile query parameter exactly 256 characters in length.
Anonymous (unauthenticated) requests to the CDN file endpoint from unexpected source IP ranges or automated user agents.
Repeated probing requests against /api/Cdn/GetFile with varying AnonFile values prior to a successful 256-character request.

Detection Strategies

Inspect web server and application logs for the /api/Cdn/GetFile path and measure the length of the AnonFile parameter for each request.
Create a WAF rule that flags or blocks requests where AnonFile length equals 256 characters.
Correlate anonymous access patterns to the endpoint against baseline traffic volumes to identify probing behavior.

Monitoring Recommendations

Forward web access logs to a centralized log analytics or SIEM platform and alert on anomalous parameter lengths.
Track 200-status responses returned by /api/Cdn/GetFile to unauthenticated callers as a deviation indicator.
Monitor outbound CDN traffic to verify no non-static content is reachable through the endpoint.

How to Mitigate CVE-2026-11345

Immediate Actions Required

Apply the patched version of linqi referenced in the vendor security advisory once available.
Review web server logs for prior requests to /api/Cdn/GetFile containing a 256-character AnonFile parameter.
Restrict the endpoint to required network ranges if it is not needed externally.

Patch Information

Refer to the Linqi Security Advisory for vendor-supplied remediation guidance and fixed versions. The advisory documents the corrected logic in ValidateAnonFileAccess that no longer treats parameter length as an authorization signal.

Workarounds

Deploy a WAF or reverse proxy rule that rejects requests to /api/Cdn/GetFile when the AnonFile parameter length equals 256 characters.
Block unauthenticated access to /api/Cdn/GetFile at the perimeter and require authenticated sessions for any non-CDN delivery path.
Confirm that only minified JavaScript and CSS resources are reachable through the endpoint and remove any non-static files from its serving directory.

bash

# Example NGINX rule rejecting AnonFile parameters of exactly 256 characters
location /api/Cdn/GetFile {
    if ($arg_AnonFile ~ "^.{256}$") {
        return 403;
    }
    proxy_pass http://linqi_backend;
}