CVE-2026-40910 Details
Description
frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1.
An authentication bypass vulnerability has been identified in frp, a fast reverse proxy, affecting versions 0.43.0 prior to 0.68.0. The issue arises in the HTTP vhost routing path when 'routeByHTTPUser' is used for access control. In proxy-style requests, the routing logic incorrectly uses the username from 'Proxy-Authorization' to select the 'routeByHTTPUser' backend, while the access control check relies on the 'Authorization' header. This discrepancy allows an attacker to access a backend protected by 'httpUser' and 'httpPassword' by exploiting the routing logic, even with an incorrect 'Proxy-Authorization' password. The vulnerability specifically impacts deployments that use 'routeByHTTPUser' and does not affect standard HTTP proxies that do not utilize this feature.
Users can upgrade to frp version 0.68.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/fatedier/frp/security/advisories/GHSA-pq96-pwvg-vrr9 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fatedier frp | >= 0.43.0, < 0.68.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |
| Apr 21, 2026 | CVE Modified | CISA-ADP |