OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization

Advisories

severity: critical
date: January 6, 2026
Affecting: OpenFlagr <= 1.1.18
CVE: CVE-2026-0650
CWE: CWE-306 Missing Authentication for Critical Function
CWE-425 Direct Request ('Forced Browsing')
CVSS: 9.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: OpenFlagr 1.1.19 Release Notes
Researcher Blog
Credit: DreyAnd
Description: OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.