Starlette Host Header Validation Bypass leading to SSRF/Auth Bypass (GHSA-86qp-5c8j-p5mr)

The following is a summary of the key vulnerability information from the webpage screenshot: --- Vulnerability Overview Title: Request Host Header not Validated in Starlette Severity Rating: High CVE: TBA GitHub ID: GHSA-86qp-5c8j-p5mr CWE: 436 CVSS Score: 7 CVSS Vector: CVSS:3.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N Description: When reconstructing the request URL, the Starlette framework relies solely on the HTTP header and the request path but performs no validation on the header value. An attacker can inject a path into the host part, prepending the actual path. Since Starlette's routing is based on the actual request path, this inconsistency can lead to security issues such as authentication bypass, SSRF, and even Remote Code Execution (RCE). --- Scope of Impact Affected Versions: starlette >= 0.8.3, < 1.0.1 Fixed Version: starlette 1.0.1 Vendor: Starlette Vendor URL: https://github.com/Kludex/starlette Affected Framework: FastAPI (built on Starlette) --- Remediation Temporary Workarounds: 1. Avoid relying on the request path to implement functionality (e.g., authentication); use endpoint names instead. 2. Use instead of . 3. Deploy a reverse proxy (such as nginx or Apache) in front of the Python application to reject invalid Host headers. 4. Use an ASGI server compliant with RFC standards to validate the Host header. Permanent Fix: Upgrade to starlette 1.0.1 or later. --- Proof of Concept (POC) After starting the service, authentication can be bypassed by constructing a malicious Host header: --- Timeline 2026-01-27: Vulnerability discovered during an unrelated source code audit 2026-02-04: PoC created and vendor contacted 2026-02-05: Vendor replied 2026-03-01: Vendor proposed a patch 2026-05-21: Patch publicly released 2026-05-22: Security advisory published --- Authors: JJ Yassine El Baaj, Markus Vervier Release Date: May 22, 2026

Goal Reached Thanks to every supporter — we hit 100%!

Starlette Host Header Validation Bypass leading to SSRF/Auth Bypass (GHSA-86qp-5c8j-p5mr)