CVE-2026-8890 Details
Description
code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header. The middleware in middleware.ts skips identity header generation when an Auth-Key header is present without validating its value, allowing attackers to inject a spoofed user identity header that the downstream route handler in the mobile courses endpoint accepts as trusted, granting unauthorized access to course data belonging to any enrolled user or administrator.
An authentication bypass vulnerability has been identified in the code100x Mobile API, affecting versions through 90b489e. This vulnerability allows unauthenticated attackers to impersonate any user by sending a manipulated JSON payload in the 'g' HTTP header. The issue arises because the middleware fails to validate the Auth-Key header, enabling the injection of a fake user identity that is trusted by the mobile courses endpoint. As a result, attackers can gain unauthorized access to course data of any enrolled user or administrator.
The vulnerability has been addressed in the code100x repository. Users should update to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 26, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/code100x/cms/issues/1924 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/code100x/cms/pull/1927 | CISA-ADP | Issue TrackingVendor |
| https://github.com/code100x/cms/issues/1924 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/code100x/cms/pull/1927 | [email protected] | Issue TrackingVendor |
| https://github.com/code100x/cms/pull/1927/changes/88c6c5e94e23da101235c4c7e9c7591ac1016549 | [email protected] | Source CodeVendor |
| https://github.com/code100x/cms/pull/1927/changes/90b489ee7c63c301107d6374d4b3f2b8e4060fe5 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/code100x-mobile-api-authentication-bypass-via-header-spoofing | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| code100x | <= 90b489e <= 88c6c5e |
CPE
Remediation
| |
| code100x cms | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |