SessionMiddleware Vulnerability in DevGuard Affects User Authentication

CVE-2026-42300

What is CVE-2026-42300?

The SessionMiddleware in DevGuard, prior to version 1.2.2, contains a vulnerability that allows an attacker to impersonate an authenticated user by exploiting the X-Admin-Token HTTP request header. When a valid Kratos session cookie is not present, this raw token value is misused as the authenticated userID. An attacker who can guess or acquire the target user's Kratos identity UUID can issue requests on behalf of that user. If the compromised account belongs to an organization admin or owner, the attacker gains full control over the organization's DevGuard resources, posing a significant security risk.

References