CVE-2026-86249

The Apache bRPC framework is vulnerable to an authentication bypass when a server configures both ServerOptions.auth and ServerOptions.internal_port. The root cause is that the HTTP built-in service exemption on internal_port is not checked per-request; the verification verdict latches to the con...