OTP httpd mod_auth auth bypass CVE-2026-71270: case-insensitive FS

Vulnerability Summary: OTP Authentication Bypass Vulnerability Overview Vulnerability Name: Authentication Bypass via Case-Insensitive Filesystem Path Matching in httpd mod_auth CVE ID: CVE-2026-71270 Severity: High (CVSS v2 Score 8.2/10) Vulnerability Type: Authentication Bypass Root Cause: The OTP module uses case-insensitive wildcard matching ( without the option) to determine protected paths. On case-insensitive filesystems (e.g., Windows, macOS default APFS, FreeBSD UFS/ZFS), an attacker can bypass authentication checks by altering the case of the path (e.g., vs. ), allowing access to protected resources without credentials. Impact Scope Affected Versions: - OTP: >= 17.0 - inetd: >= 5.10 Affected Environments: - Deployments on Windows or macOS (or any case-insensitive filesystem) - Use of case-insensitive filesystems (e.g., FreeBSD’s default UFS/ZFS) Unaffected: Linux deployments (its filesystems are case-sensitive by default and will reject paths with mismatched case) Fixes Fixed Versions: - OTP: 29.0.6, 28.5.0.6, 27.3.4.17 - inetd: 9.7.2, 9.6.2.3, 9.3.2.7 Temporary Mitigations (Workarounds): 1. Deploy httpd on a case-insensitive filesystem or macOS (or any case-insensitive filesystem) 2. Use an authenticating reverse proxy that performs case-insensitive path matching 3. Utilize front-end proxy rewrite rules to normalize request URLs to lowercase before they reach httpd POC / Exploit Code The page does not include a POC code or exploit code block; it only describes the exploitation method in text: a request to or can both bypass authentication to access the protected file.

Goal Reached Thanks to every supporter — we hit 100%!

OTP httpd mod_auth auth bypass CVE-2026-71270: case-insensitive FS

More from this source