CVE-2026-32136 Details

A critical authentication bypass vulnerability has been identified in AdGuard Home versions prior to 0.107.73. An unauthenticated remote attacker can exploit this issue by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is managed by an inner multiplexing layer that lacks authentication middleware. This flaw allows all subsequent HTTP/2 requests on that connection to be processed as fully authenticated, regardless of whether any credentials were provided. The vulnerability arises because the HTTP server's authentication middleware only wraps the outer layer, leaving the inner h2c handler unprotected.

Users can upgrade to AdGuard Home version 0.107.73 or later, where this vulnerability has been fixed. Alternatively, the authentication middleware can be moved inside the h2c handler to ensure it applies to all connections, or if h2c support is not needed, the h2c handler can be removed entirely.