CVE-2026-8890: code100x Auth Bypass Vulnerability

CVE-2026-8890 Overview

CVE-2026-8890 is an authentication bypass vulnerability in the code100x content management system Mobile API. Unauthenticated attackers can impersonate arbitrary users by supplying a crafted JSON payload in the g HTTP header. The middleware in middleware.ts skips identity header generation when an Auth-Key header is present, but does not validate the value of that header. Attackers inject a spoofed user identity header that the downstream route handler in the mobile courses endpoint accepts as trusted. This grants unauthorized access to course data belonging to any enrolled user or administrator [CWE-639].

Critical Impact
Remote, unauthenticated attackers can impersonate any user, including administrators, and access protected course data through the Mobile API.

Affected Products

code100x CMS (Mobile API component)
middleware.ts identity header generation logic
Mobile courses route handler

Discovery Timeline

2026-05-26 - CVE-2026-8890 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-8890

Vulnerability Analysis

The flaw is an Authorization Bypass Through User-Controlled Key issue in the code100x CMS Mobile API. The middleware.ts file is responsible for generating a trusted identity header that downstream route handlers consume to determine the requesting user. When a client supplies an Auth-Key header, the middleware treats the request as pre-authenticated and skips its own identity header generation step. The middleware never validates the contents or authenticity of the Auth-Key value before making this decision.

Because the middleware does not regenerate or overwrite the identity header in this code path, an attacker-supplied identity header passes through to the route handler unchanged. The mobile courses endpoint then parses the g HTTP header as a JSON payload describing the current user and trusts its contents. An attacker sets the user identifier inside that JSON to any account, including administrators, and the application returns the corresponding course data.

The Exploit Prediction Scoring System (EPSS) lists this issue at 0.08% with a percentile of 23.7, but the trivial exploitation primitive makes opportunistic abuse plausible once details are public.

Root Cause

The root cause is missing validation in middleware.ts. The middleware uses the presence of the Auth-Key header as a trust signal and conditionally bypasses identity header generation. No cryptographic check, allow list, or session lookup validates that the caller is permitted to assert an identity. The downstream handler compounds the issue by trusting any client-supplied identity header without re-verification.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the Mobile API courses endpoint with two crafted headers: an arbitrary Auth-Key value to trigger the middleware bypass, and a g header containing a JSON document that names the target user identifier. The server returns the impersonated user's course data in the response. See the VulnCheck Security Advisory for additional technical detail.

Detection Methods for CVE-2026-8890

Indicators of Compromise

Mobile API requests containing both an Auth-Key header and a g header with a JSON payload.
Successful HTTP 200 responses to /api/mobile/courses endpoints from clients that never completed a login flow.
Bursts of requests from a single source enumerating numeric or sequential user identifiers in the g header.

Detection Strategies

Inspect web server and reverse proxy logs for the literal Auth-Key header on Mobile API routes and alert when it appears outside of approved internal callers.
Parse the g header on inbound traffic and flag requests whose JSON identity does not match an authenticated session cookie or token.
Correlate identity values asserted in the g header with subsequent application activity to detect a single source acting as multiple users.

Monitoring Recommendations

Enable verbose access logging for all /api/mobile/* routes, including request headers, source IP, and resolved user ID.
Forward Mobile API logs to a centralized analytics platform and build dashboards for header anomalies and impersonation attempts.
Track rate of 200 OK responses on mobile course endpoints per source IP and alert on unusual spikes.

How to Mitigate CVE-2026-8890

Immediate Actions Required

Apply the upstream fix from code100x Pull Request #1927 to all production and staging deployments.
Strip or reject the Auth-Key and g headers at the reverse proxy or web application firewall until the patch is deployed.
Audit application logs for prior requests carrying these headers and review affected user accounts for unauthorized data access.

Patch Information

The maintainers tracked the issue in GitHub Issue #1924 and merged the fix in GitHub Pull Request #1927. The relevant code changes are visible in commits 88c6c5e9 and 90b489ee. The patch validates the Auth-Key value and forces server-side regeneration of the identity header rather than trusting client-supplied values.

Workarounds

Configure the reverse proxy (NGINX, Cloudflare, or equivalent) to drop the Auth-Key and g request headers before they reach the application.
Require a valid session cookie or bearer token on all /api/mobile/* routes and reject anonymous requests at the edge.
Restrict Mobile API endpoints to known mobile client IP ranges or signed client certificates where feasible.

bash

# Example NGINX configuration to strip spoofable headers on the Mobile API
location /api/mobile/ {
    proxy_set_header Auth-Key "";
    proxy_set_header g "";
    proxy_pass http://code100x_backend;
}