CVE-2026-90449

Received Received - Intake

Authentication Bypass in Third-Party Admin Interface

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which manages the credential store used to gate every other service in the deployment, is delegated entirely to that third-party interface's own login mechanism. Any authentication weakness in that bundled interface would compromise the credential store protecting the rest of the deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90449

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when a reverse proxy is configured to forward requests for a bundled third-party administrative interface without enforcing its own authentication first. The gateway delegates all access control to the third-party interface's login mechanism, which manages the credential store for the entire deployment. If the third-party interface has authentication weaknesses, it could compromise the credential store protecting other services.

Impact Analysis

An attacker could exploit authentication weaknesses in the third-party administrative interface to gain unauthorized access to the credential store. This would allow them to compromise the security of every service protected by that credential store, potentially leading to data breaches, unauthorized system access, or further lateral movement within the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face regulatory penalties, loss of compliance certifications, and reputational damage due to potential data exposure or unauthorized access to protected health or personal information.

Mitigation Strategies

Disable the affected authentication mode configuration that forwards requests to the third-party administrative interface without gateway authentication. Ensure the gateway enforces its own authentication before allowing access to any administrative interfaces.

Hi! I’m here to help you understand CVE-2026-90449. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70