CVE-2026-58399 Details
Description
@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers. The validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs. A fix has been implemented in v2.3.0.
A vulnerability allowing unauthenticated authentication bypass has been identified in @acastellon/auth version 2.2.0. This issue arises in the validateToken() middleware, which can be bypassed through spoofable auth-user and Host request headers. The vulnerability allows remote attackers to send crafted requests that bypass token validation, exploiting a service-to-service bypass related to the auth-user header. The issue has been fixed in version 2.3.0.
Users are advised to update to @acastellon/auth version 2.3.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/antonio-castellon/module-auth/issues/6 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw | [email protected] | AdvisoryRemedyVendor |
| https://www.npmjs.com/package/@acastellon/auth/v/2.3.0 | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @acastellon/auth | < 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |