Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt
CVE-2026-45567

8.3HIGH

Key Information:

Vendor

Roxy-wi

Status
Roxy-wi
Vendor
CVE Published:
10 June 2026

What is CVE-2026-45567?

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.

Affected Version(s)

roxy-wi <= 8.2.6.4

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.