Authentication Bypass in Mobile API of code100x Platform

CVE-2026-8890

What is CVE-2026-8890?

The code100x Mobile API is vulnerable to authentication bypass, allowing attackers to impersonate any user by sending a specially formatted JSON payload in the 'g' HTTP header. When an Auth-Key header is included, the system fails to validate its value, which allows the injection of a spoofed user identity header. As a result, unauthorized users can gain access to sensitive course data of any student or administrator enrolled in the system, creating significant security risks.

References