CVE-2026-49446 Details
Description
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.
An authentication bypass vulnerability has been identified in Cosmos versions prior to 0.22.19. The issue arises in the tokenMiddleware function, where the Constellation tunnel bypass branch returns to the upstream handler before removing certain headers and before executing the AdminOnlyWithRedirect function. This allows an attacker with a valid Constellation API key to impersonate users and gain unauthorized access to admin-level data or functions in proxied applications.
Update to Cosmos version 0.22.19 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf | [email protected] | Source CodeVendor |
| https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19 | [email protected] | Release NotesVendor |
| https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Azukaar Cosmos | <= 0.22.18 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | New CVE Received | [email protected] |
| Sep 15, 2026 | CVE Modified | CISA-ADP |