Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-40910— frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control

Quick assessment

Affected
fatedier frp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

frp是fatedier个人开发者的一个内网穿透反向代理工具。 frp 0.43.0版本至0.68.0版本存在授权问题漏洞，该漏洞源于使用routeByHTTPUser进行访问控制时，HTTP vhost路由路径存在身份验证绕过，可能导致攻击者即使提供错误的Proxy-Authorization密码，仍能访问受httpUser/httpPassword保护的后端。

CVSS 6.5 · Medium EPSS 0.40% · P32

Possible ATT&CK Techniques 1 AI

T1110 · Brute Force
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-40910

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control
Source: CVE Program / CVE List V5
Vulnerability Description
frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
frp 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
frp是fatedier个人开发者的一个内网穿透反向代理工具。 frp 0.43.0版本至0.68.0版本存在授权问题漏洞，该漏洞源于使用routeByHTTPUser进行访问控制时，HTTP vhost路由路径存在身份验证绕过，可能导致攻击者即使提供错误的Proxy-Authorization密码，仍能访问受httpUser/httpPassword保护的后端。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
fatedier frp < 0.68.1 -

II. Public POCs for CVE-2026-40910

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-40910

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-40910 (1)

IV. Related Vulnerabilities

Same product: frp
Same vendor: fatedier
Same weakness: CWE-287

V. Comments for CVE-2026-40910

No comments yet

Leave a comment