User Impersonation

Overview @acastellon/auth is an Authorization Filtering for NodeJS Express Application NTLM + LDAP + JWT + AWS Cognito + Azure AD/Entra ID + OIDC providers + SAML + env var secrets Affected versions of this package are vulnerable to User Impersonation via the validateToken process. An attacker ca...

PT-2026-54912

Name of the Vulnerable Software and Affected Versions @acastellon/auth versions prior to 2.3.0 Description An authentication bypass exists in the validateToken middleware. The issue stems from improper trust in spoofable request headers and flawed request flow control, which allows the next...