CVE-2026-86249

Apache bRPC versions prior to 1.18.0 are vulnerable to an authentication bypass when both ServerOptions.auth and ServerOptions.internal_port are configured. The VerifyHttpRequest() function returns true without checking credentials when a built-in service is requested on the internal_port. Becaus...