CVE-2026-108548— AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
Quick assessment
Affected
iflytek astron-rpa
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AstronRPA 1.1.6 及之前版本在 OpenResty 网关的 auth_handler.lua 文件中存在认证绕过漏洞，该组件会接受任何未经过验证的 Bearer Token。未经认证的攻击者可以向 /api/resource/ 和 /api/rpa-ai-service/ 路由发送任意 Bearer 值，并伪造 X-User-Id 或 user_id 请求头，从而伪装成任意用户进行操作。
Possible ATT&CK Techniques 3 AI
T1136 · Create Account T1078 · Valid Accounts T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| iflytek | astron-rpa | ≤ 1.1.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108548
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
Source: CVE Program / CVE List V5
Vulnerability Description
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| iflytek | astron-rpa | 0 ~ 1.1.6 | - |
|
II. Public POCs for CVE-2026-108548
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108548
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-108548 (1)
News Coverage for CVE-2026-108548 (1)
Other References for CVE-2026-108548 (1)
-
🔗 Unicorn! · GitHub technical-description
Same Patch Batch · iflytek · 2026-10-10 · 3 CVEs total
| CVE-2026-108550 | 8.8 HIGH | SkillHub before 0.2.22 Account Takeover via Account Merge Flow |
| CVE-2026-108547 | 6.5 MEDIUM | AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var |
IV. Related Vulnerabilities
Same vendor: iflytek
-
CVE-2026-108864
iFlytek Astron Agent through 1.1.2 Authorization Bypass via -
CVE-2026-108550
SkillHub before 0.2.22 Account Takeover via Account Merge Fl -
CVE-2026-108547
AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclos -
CVE-2026-108263
Astron Agent: Unsandboxed code-node leads to cross-tenant RC -
CVE-2026-108160
AstronRPA through 1.1.6 Unsigned Update Installation via Pla
Same weakness: CWE-287
-
CVE-2026-109082
Keycloak-services: keycloak-services: ciba confidential-only -
CVE-2026-108865
AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via -
CVE-2026-108522
Studio-Saelix Sencho Login Endpoint login improper authentic -
CVE-2026-108707
Wukong_HRM through commit 186115e Authentication Bypass via -
CVE-2026-104759
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365
V. Comments for CVE-2026-108548
No comments yet