PT-2026-120568

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal port, the HTTP built-in service exemption on internal port can be abused to bypass authentication entirely. VerifyHttpRequest returns true without checking any credential when a built-in service is requested on interna...