CVE-2026-58399: acastellon/auth Auth Bypass Vulnerability

CVE-2026-58399 Overview

CVE-2026-58399 is an authentication bypass vulnerability in @acastellon/auth, an authentication control system for microservices distributed as an npm package. Versions prior to 2.3.0 allow unauthenticated attackers to bypass token validation in the validateToken() middleware. The flaw resides in a service-to-service shortcut that trusts two client-controlled request headers: auth-user and Host. A remote attacker can craft an HTTP request that satisfies the bypass condition and skip legacy, JWT, and OpenID Connect (OIDC) validation logic. The maintainer released a fix in version 2.3.0.

Critical Impact
Unauthenticated remote attackers can bypass authentication in any service using @acastellon/auth < 2.3.0, gaining access as the service-brother identity without valid credentials.

Affected Products

@acastellon/auth npm package, all versions prior to 2.3.0
Microservices deploying @acastellon/auth as authentication middleware
Node.js applications relying on validateToken() for request authorization

Discovery Timeline

2026-07-01 - CVE-2026-58399 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58399

Vulnerability Analysis

The vulnerability is classified as an authentication bypass [CWE-287]. It exists within the validateToken middleware that gates access to protected microservice routes. The middleware implements a service-to-service shortcut intended to allow trusted internal callers to skip full token validation. This shortcut evaluates two values before any cryptographic or token-based checks execute. Both values originate from the incoming HTTP request and are fully controlled by the client.

When the shortcut condition matches, the middleware treats the request as authenticated and forwards it to the downstream handler. Legacy session validation, JSON Web Token (JWT) signature verification, and OIDC flows never run for these requests. The result is a pre-authentication bypass reachable over the network without credentials or user interaction.

Root Cause

The root cause is misplaced trust in request-supplied metadata. The middleware compares the auth-user header against the literal string service-brother and checks whether req.get('host') begins with the value returned by getHostName(). Both inputs traverse the network from the client. HTTP clients set the Host header freely, and custom headers such as auth-user are equally spoofable. No mutual TLS, shared secret, signed identity token, or network-layer control validates that the caller is genuinely an internal service.

Attack Vector

An unauthenticated attacker sends an HTTP request to any endpoint protected by validateToken(). The attacker sets auth-user: service-brother and sets the Host header to a value beginning with the hostname the target expects. The middleware matches the shortcut, marks the request as trusted, and skips token validation. Downstream handlers then execute with the privileges associated with the service-brother identity, exposing integrity-sensitive operations across the microservice.

No authenticated session, valid token, or prior access is required. The attack is reachable across any network path that reaches the vulnerable service.

Detection Methods for CVE-2026-58399

Indicators of Compromise

HTTP requests containing the header auth-user: service-brother originating from external or untrusted network segments.
Requests where the Host header begins with an internal service hostname but the source IP is not part of the internal service mesh.
Access to privileged endpoints without a preceding /login, /token, or OIDC callback flow in the same session.

Detection Strategies

Deploy web application firewall (WAF) or reverse proxy rules that strip or reject inbound auth-user headers at the perimeter.
Parse application access logs for validateToken shortcut hits and correlate them with source IP reputation and network zone.
Baseline the volume of service-brother calls per deployment; alert on any occurrence sourced outside expected pod or node CIDR ranges.

Monitoring Recommendations

Enable verbose logging in validateToken() to record which validation branch (shortcut, legacy, JWT, OIDC) authorized each request.
Forward microservice access logs to a centralized data lake and query for anomalous Host header values that match internal hostnames from external sources.
Monitor npm dependency manifests across CI/CD pipelines to flag any project pinned below @acastellon/auth 2.3.0.

How to Mitigate CVE-2026-58399

Immediate Actions Required

Upgrade @acastellon/auth to version 2.3.0 or later in every microservice and rebuild container images.
Audit reverse proxies, ingress controllers, and API gateways to strip client-supplied auth-user headers before they reach the application.
Review access logs from before the upgrade for requests carrying auth-user: service-brother from unexpected source addresses.

Patch Information

The maintainer released a fix in NPM Package Version 2.3.0. Details of the shortcut behavior and the remediation are documented in the GitHub Security Advisory GHSA-gfj5-979r-92pw and the related GitHub Issue Discussion.

Workarounds

Configure the ingress or reverse proxy to unconditionally remove the auth-user request header from all inbound traffic.
Restrict access to validateToken()-protected services to authenticated mesh traffic using mutual TLS (mTLS) or a service mesh identity policy.
If upgrading is not immediately feasible, patch the deployment locally to remove the service-brother shortcut and require full JWT or OIDC validation on every request.

bash

# Configuration example: strip spoofable header at NGINX ingress
server {
    listen 443 ssl;
    server_name api.internal.example.com;

    location / {
        proxy_set_header auth-user "";
        proxy_set_header Host $host;
        proxy_pass http://microservice_upstream;
    }
}