CVE-2026-101916

Received Received - Intake

Authentication Bypass in gRPC JavaScript Library

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-101916

EUVD

EUVD-2026-88476

Affected Vendors & Products

Vendor	Product	Version / Range
grpc	grpc-js	to 1.14.5 (exc)
grpc	grpc-js-xds	to 1.14.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

The vulnerability affects @grpc/grpc-js versions before 1.13.6 and 1.14.5. It involves the getAuthContext function not properly distinguishing between authorized and unauthorized peer certificates when server credentials require client certificates but are set to false. This can lead applications to treat unauthorized certificates as authorized, causing improper authentication.

Detection Guidance

To detect this vulnerability, check the version of @grpc/grpc-js or @grpc/grpc-js-xds in use. If the version is below 1.13.6 or 1.14.5, the system is vulnerable. Run commands like 'npm list @grpc/grpc-js' or 'npm list @grpc/grpc-js-xds' to verify installed versions.

Impact Analysis

This vulnerability allows unauthorized access to systems or data if an attacker presents an invalid certificate that is incorrectly treated as valid. Applications relying on authentication context may grant access to unauthorized users, potentially leading to data breaches or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust due to improper authentication.

Mitigation Strategies

Update @grpc/grpc-js to version 1.13.6, 1.14.5, or later to address the improper authentication issue. For grpc-js-xds, ensure RBAC authentication is properly configured and updated to a fixed version.

Hi! I’m here to help you understand CVE-2026-101916. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70