Vulnerability · Published Jan 7, 2026 · Assigned by VulnCheck

CVE-2026-0650OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization

Critical 9.3

In plain English

A critical-severity missing authentication in Flagr from OpenFlagr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)1.5%top 25.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials. Unauthorized access may allow modification of feature flags and export of sensitive data.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/openflagr/flagr	0.0.0-20251009103504-fe83dc87aa40	GHSA-rwp9-5g7q-73q3
Go	github.com/openflagr/flagr	0.0.0-20251009103504-fe83dc87aa40	GO-2026-4286

Affected products (as reported)

Vendor	Product	Versions
OpenFlagr	Flagr	0 – through 1.1.18

Weakness: CWE-306, CWE-425 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/openflagr/flagr/releases/tag/1.1.19 release-notes, patch
https://dreyand.rs/code%20review/golang/2026/01/03/0day-speedrun-openflagr-less-1118-authentication-bypass technical-description, exploit
https://www.vulncheck.com/advisories/openflagr-authentication-bypass-via-prefix-whitelist-path-normalization third-party-advisory