Authentication Bypass in @acastellon/auth for Microservices
CVE-2026-58399

8.7HIGH

Key Information:

Vendor

Antonio-castellon

Status
Module-auth
Vendor
CVE Published:
1 July 2026

What is CVE-2026-58399?

The @acastellon/auth library, which is utilized for authentication in microservices, is susceptible to a significant security flaw in versions prior to 2.3.0. This vulnerability allows an unauthorized user to bypass the token validation process by manipulating the 'auth-user' and 'Host' request headers. This flaw is caused by the validateToken middleware's reliance on these headers, which can be easily spoofed by a remote attacker using crafted HTTP requests. Consequently, this permits potential unauthorized access to services before hitting the legacy or JWT/OIDC validation logic. Users are advised to upgrade to version 2.3.0 or later to mitigate this risk.

Affected Version(s)

module-auth < 2.3.0

References

https://github.com/antonio-castellon/module-auth/security...
x_refsource_CONFIRM
https://github.com/antonio-castellon/module-auth/issues/6
x_refsource_MISC
https://www.npmjs.com/package/@acastellon/auth/v/2.3.0
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.