Cloudanix VulnDB

GHSA-pq96-pwvg-vrr9

Medium · 6.5

frp has an authentication bypass in HTTP vhost routing when routeByHTTPUser is used for access control

CVSS

6.5

EPSS

—

Published

Apr 14, 2026

CISA due date

—

The record

frp contains an authentication bypass in the HTTP vhost routing path when `routeByHTTPUser` is used as part of access control. In proxy-style requests, the routing logic uses the username from `Proxy-Authorization` to select the `routeByHTTPUser` backend, while the access control check uses credentials from the regular `Authorization` header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected `routeByHTTPUser` value may access a backend protected by `httpUser` / `httpPassword` even with an incorrect `Proxy-Authorization` password. This issue affects deployments that explicitly use `routeByHTTPUser`. It does not affect ordinary HTTP proxies that do not use this feature.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities