CVE-2026-49446 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...

EUVD-2026-78588

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...

CVE-2026-49446 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...

CVE-2026-49446 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...

CVE-2026-49446

Cosmos-Server (a self-hosted secure gateway and server manager by azukaar ) is vulnerable to authentication bypass via forward-auth header smuggling on its Constellation tunnel in versions prior to 0.22.19 . The tokenMiddleware in src/proxy/routerGen.go returns through the Constellation bypass br...

CVE-2026-49446: Improper Authorization

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...

The vulnerability of the Azure Cosmos DB database management system, related to bypassing authentication using a user-controlled key, allows attackers to perform spear-phishing attacks.

The vulnerability of the Azure Cosmos DB database management system is related to the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to perform brute-force attacks remotely...

Azure Cosmos DB Spoofing Vulnerability

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...

SUSE CVE-2026-49447

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

EUVD-2026-70796

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...

CVE-2026-69857

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...

CVE-2026-69857 Azure Cosmos DB Spoofing Vulnerability

...

CVE-2026-69857

Azure Cosmos DB is affected by an authorization bypass through user-controlled key , allowing an authorized attacker to perform spoofing over a network. The vulnerability is rated CVSS 3.1: 8.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a changed scope and hi...

CVE-2026-69857 Azure Cosmos DB Spoofing Vulnerability

...

CVE-2026-69857: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...

KLA91257 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability i...

PT-2026-85310

🚨 HIGH: CVE-2026-69857 CVSS 8.5 - Authorization bypass in Azure Cosmos DB allows authenticated attackers to perform spoofing over network. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/jpe1VOsLLc...

GHSA-7G4W-CG88-2CQ2

creationtimestamp| type| source ---|---|--- 2026-08-28 20:59:24+00:00| seen| https://bsky.app/profile/newssecia.bsky.social/post/3mu6ax42wfx2g 2026-08-28 22:00:41+00:00| seen| https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html 2026-08-29 01:00:36+00:00| seen|...

MAL-2026-14305 Malicious code in mc-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...

Malicious code in mc-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...