QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-8890

Back to search

CVE-2026-8890

Published: May 26, 2026

Modified: May 26, 2026

PUBLISHED

CVSS v3.1

8.2

HIGH

Description

code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header. The middleware in middleware.ts skips identity header generation when an Auth-Key header is present without validating its value, allowing attackers to inject a spoofed user identity header that the downstream route handler in the mobile courses endpoint accepts as trusted, granting unauthorized access to course data belonging to any enrolled user or administrator.

VendorProductVersions

code100x

code100x

affected
0 - < 90b489ee7c63c301107d6374d4b3f2b8e4060fe5
affected
0 - < 88c6c5e94e23da101235c4c7e9c7591ac1016549

Weaknesses (CWE)

CWE-639

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now