CVE-2026-48710 Details

A critical authentication bypass vulnerability has been identified in Starlette, a lightweight ASGI framework, in versions prior to 1.0.1. The issue arises because the framework does not validate the HTTP 'Host' request header before using it to reconstruct 'request.url'. This lack of validation allows attackers to manipulate the 'request.url.path', creating a discrepancy between the path that was actually requested and what the application processes. As a result, middleware and endpoints that enforce security based on 'request.url' can be bypassed. This vulnerability affects many applications built with FastAPI, which relies on Starlette, as well as various AI frameworks and tools that use these libraries.

Upgrade to Starlette version 1.0.1 or later, and replace any usage of 'request.url' or 'request.url.path' in middleware or security-related code with 'request.scope["path"]'. Additionally, consider deploying a reverse proxy that rejects malformed 'Host' headers before the request reaches the Starlette application.