CVE-2026-86249 Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internalport, the HTTP built-in service exemption on internalport can be abused to bypass authentication entirely. VerifyHttpRequest returns true without checking any credential when a built-in service is requested on...