CVE-2026-108548 Details
Description
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.
An authentication bypass vulnerability has been identified in AstronRPA versions through 1.1.6. The issue resides in the OpenResty gateway's authentication handler, which accepts any Bearer token without proper validation. This flaw allows unauthenticated attackers to send arbitrary Bearer tokens to the /api/resource/ and /api/rpa-ai-service/ routes. Exploitation of this vulnerability also enables the spoofing of X-User-Id or user_id headers, potentially allowing attackers to impersonate any user.
Users can update to AstronRPA version 1.1.7 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/iflytek/astron-rpa | [email protected] | Vendor |
| https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/ai-service/app/dependencies/__init__.py#L10-L24 | [email protected] | Source CodeVendor |
| https://github.com/iflytek/astron-rpa/blob/v1.1.6/docker/volumes/nginx/lua/auth_handler.lua#L21-L35 | [email protected] | Source CodeVendor |
| https://github.com/iflytek/astron-rpa/issues/886 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-authentication-bypass-via-arbitrary-bearer-token | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| iFlytek AstronRPA | <= 1.1.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |