{"id":"CVE-2026-8890","title":"code100x Mobile API Authentication Bypass via Header Spoofing","summary":"code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header. The middleware in middleware.ts s…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"code100x","product":"code100x","affected":["code100x < 90b489ee7c63c301107d6374d4b3f2b8e4060fe5","code100x < 88c6c5e94e23da101235c4c7e9c7591ac1016549"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-05-26T19:25:26.818588Z"},"exploitAvailable":true,"published":"2026-05-26","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:09:19.016Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-8890","references":[{"url":"https://github.com/code100x/cms/issues/1924"},{"url":"https://github.com/code100x/cms/pull/1927"},{"url":"https://github.com/code100x/cms/pull/1927/changes/90b489ee7c63c301107d6374d4b3f2b8e4060fe5"},{"url":"https://github.com/code100x/cms/pull/1927/changes/88c6c5e94e23da101235c4c7e9c7591ac1016549"},{"url":"https://www.vulncheck.com/advisories/code100x-mobile-api-authentication-bypass-via-header-spoofing"}],"tags":["cve.org","exploit-available"],"epss":0.0049,"epssPercentile":0.42425,"ingestedAt":"2026-11-08T14:51:22.250Z","slug":"CVE-2026-8890","body":"## Overview\n\ncode100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header. The middleware in middleware.ts skips identity header generation when an Auth-Key header is present without validating its value, allowing attackers to inject a spoofed user identity header that the downstream route handler in the mobile courses endpoint accepts as trusted, granting unauthorized access to course data belonging to any enrolled user or administrator.\n\n## Affected\n\n- `code100x < 90b489ee7c63c301107d6374d4b3f2b8e4060fe5`\n- `code100x < 88c6c5e94e23da101235c4c7e9c7591ac1016549`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}