---
id: CVE-2026-8890
title: code100x Mobile API Authentication Bypass via Header Spoofing
summary: >-
  code100x contains an authentication bypass vulnerability in the Mobile API
  that allows unauthenticated attackers to impersonate arbitrary users by
  supplying a crafted JSON payload in the 'g' HTTP header. The middleware in
  middleware.ts s…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: code100x
product: code100x
affected:
  - code100x < 90b489ee7c63c301107d6374d4b3f2b8e4060fe5
  - code100x < 88c6c5e94e23da101235c4c7e9c7591ac1016549
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-05-26T19:25:26.818588Z'
exploitAvailable: true
published: '2026-05-26'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:09:19.016Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-8890'
references:
  - url: 'https://github.com/code100x/cms/issues/1924'
  - url: 'https://github.com/code100x/cms/pull/1927'
  - url: >-
      https://github.com/code100x/cms/pull/1927/changes/90b489ee7c63c301107d6374d4b3f2b8e4060fe5
  - url: >-
      https://github.com/code100x/cms/pull/1927/changes/88c6c5e94e23da101235c4c7e9c7591ac1016549
  - url: >-
      https://www.vulncheck.com/advisories/code100x-mobile-api-authentication-bypass-via-header-spoofing
tags:
  - cve.org
  - exploit-available
epss: 0.0049
epssPercentile: 0.42425
ingestedAt: '2026-11-08T14:51:22.250Z'
---

## Overview

code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted JSON payload in the 'g' HTTP header. The middleware in middleware.ts skips identity header generation when an Auth-Key header is present without validating its value, allowing attackers to inject a spoofed user identity header that the downstream route handler in the mobile courses endpoint accepts as trusted, granting unauthorized access to course data belonging to any enrolled user or administrator.

## Affected

- `code100x < 90b489ee7c63c301107d6374d4b3f2b8e4060fe5`
- `code100x < 88c6c5e94e23da101235c4c7e9c7591ac1016549`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.