Authorization Bypass Vulnerability in Vulnerability-Lookup Product by Vulnerability Lookup

CVE-2026-73405

What is CVE-2026-73405?

An authorization bypass vulnerability in the Vulnerability-Lookup product enables inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams via the /pubsub/subscribe/ endpoint. The issue arises because the token_required decorator in the Pub/Sub interface authenticates requests by simply matching the X-API-KEY header with an existing user API key, without confirming whether the account is active or confirmed. This flaw allows attackers to create accounts and exploit the keys for unauthorized access to sensitive stream events, exposing potentially unmoderated data. The vulnerability highlights the inconsistencies in authorization enforcement between the REST API and the SSE streaming interface. The recent patch addresses this by ensuring that only active and confirmed accounts can access Pub/Sub streams, aligning the SSE authorization requirements with those of the REST API.

References