CVE-2026-90447

Received Received - Intake

Authentication Bypass via Header Manipulation

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this header to route around the primary role-based authorization check and reach the alternate path's fixed, elevated role instead. This allows a low-privileged authenticated attacker who knows the shared credential to perform actions reserved for a higher-privileged role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90447

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability involves a routing rule that chooses between two authentication mechanisms for a service based on a client-supplied request header. An attacker with a shared service credential can manipulate this header to bypass role-based authorization checks and gain elevated access.

Detection Guidance

This vulnerability involves improper routing based on client-supplied headers, bypassing role-based authorization. Detection requires inspecting authentication and routing logic for header-based path selection. Check application logs for unusual header values like 'X-Auth-Route' or similar that may trigger alternate authentication paths. Validate if low-privileged users can access elevated roles via manipulated headers.

Impact Analysis

If you are an authenticated user with a shared credential, an attacker could exploit this to perform actions requiring higher privileges. This could lead to unauthorized access, data manipulation, or other malicious activities depending on the service's role-based controls.

Compliance Impact

This vulnerability allows low-privileged authenticated users to bypass role-based authorization checks, potentially gaining unauthorized access to elevated privileges. This could lead to unauthorized data access or modifications, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy).

Mitigation Strategies

Immediately review and restrict routing rules that use client-supplied headers for authentication selection. Ensure all authentication paths enforce role-based authorization checks consistently. Remove any alternate paths with elevated roles accessible via shared credentials.

Hi! I’m here to help you understand CVE-2026-90447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70