CVE-2026-75325: DWSurvey Authentication Bypass Vulnerability

CVE-2026-75325 Overview

CVE-2026-75325 is an authentication bypass vulnerability in DWSurvey v6.14.0, an open-source survey management platform. Attackers can access restricted API endpoints without valid credentials by targeting the /api/dwsurvey/none/ and /api/dwsurvey/up/** URL paths. The flaw allows unauthenticated network requests to reach functionality that should require session-based authorization. Because the affected endpoints handle survey data and administrative operations, exploitation exposes sensitive application state to any remote actor able to reach the service.

Critical Impact
Unauthenticated remote attackers can bypass authentication controls on DWSurvey v6.14.0 by requesting specific API paths, exposing protected functionality without credentials.

Affected Products

DWSurvey v6.14.0
Endpoints under /api/dwsurvey/none/
Endpoints under /api/dwsurvey/up/**

Discovery Timeline

2026-08-26 - CVE-2026-75325 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75325

Vulnerability Analysis

DWSurvey exposes API routes that are intended to be reachable only after successful authentication. In version 6.14.0, the URL patterns /api/dwsurvey/none/ and /api/dwsurvey/up/** are excluded from the server-side authentication filter chain. Requests matching these patterns bypass the authentication middleware and reach the underlying controllers directly.

The result is a broken access control condition [CWE-287]. Any remote client that can reach the application over HTTP can invoke sensitive handlers by prefixing requests with the unprotected paths. This includes reading or manipulating survey resources that should be gated by user identity.

The issue is a configuration-level authentication bypass rather than a memory or injection flaw. It stems from overly permissive URL pattern matching in the security filter definition. Additional technical details are documented in the GitHub CVE PoC Repository.

Root Cause

The root cause is an insecure security filter configuration. The application whitelists the /api/dwsurvey/none/ and /api/dwsurvey/up/** URL prefixes from authentication checks, but protected functional endpoints are reachable through those same prefixes. The path-matching logic does not enforce a strict boundary between public and private routes.

Attack Vector

Exploitation requires only network access to the DWSurvey HTTP interface. An attacker issues a standard HTTP request to a protected API operation, routed through the unauthenticated path prefix. No credentials, tokens, or user interaction are required. The server processes the request as if authorization succeeded and returns the protected response.

See the GitHub CVE PoC Repository for request examples and endpoint enumeration.

Detection Methods for CVE-2026-75325

Indicators of Compromise

Unauthenticated HTTP requests to URIs beginning with /api/dwsurvey/none/ or /api/dwsurvey/up/
Access log entries showing successful 200 OK responses to survey administration APIs without a preceding authentication event
Bursts of enumeration traffic against /api/dwsurvey/* paths from a single source IP
Data egress spikes correlated with API calls that lack session cookies or authorization headers

Detection Strategies

Inspect web server and reverse proxy logs for requests containing the vulnerable path prefixes and no Authorization header or session cookie.
Correlate DWSurvey application logs with authentication events to identify API responses served without a matching login.
Deploy WAF rules that require authenticated context for requests targeting /api/dwsurvey/ beyond documented public endpoints.

Monitoring Recommendations

Alert on any external client accessing DWSurvey API paths that historically produced only authenticated traffic.
Baseline normal request volume per client for /api/dwsurvey/* and flag statistical outliers.
Forward DWSurvey access logs to a centralized analytics pipeline for retention and retrospective review.

How to Mitigate CVE-2026-75325

Immediate Actions Required

Restrict network access to DWSurvey v6.14.0 instances until a vendor patch is applied, allowing only trusted internal networks.
Block or challenge external requests to /api/dwsurvey/none/ and /api/dwsurvey/up/** at the reverse proxy or WAF layer.
Audit recent access logs for unauthenticated hits on the affected paths and review any survey data that may have been exposed.
Rotate any credentials, API keys, or tokens that may have been accessible through the bypassed endpoints.

Patch Information

No vendor advisory or fixed version was listed in the NVD entry at the time of publication. Monitor the DWSurvey project on GitHub for a security release and upgrade beyond version 6.14.0 once available. Confirm patched builds by testing that requests to the vulnerable path prefixes return 401 or 403 responses.

Workarounds

Enforce authentication at an upstream reverse proxy for all /api/dwsurvey/* routes, overriding the application's built-in filter chain.
Remove /api/dwsurvey/none/ and /api/dwsurvey/up/** from any public exposure list and require VPN or mTLS for access.
Apply IP allow-listing so that only known administrator endpoints can reach the DWSurvey API surface.

bash

# Configuration example: nginx path-based auth enforcement
location ~ ^/api/dwsurvey/(none|up)/ {
    auth_request /_auth_check;
    proxy_pass http://dwsurvey_backend;
}

location = /_auth_check {
    internal;
    proxy_pass http://auth_service/verify;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}