Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-75627Bastillion Authentication Bypass via Path-Prefix Routing Mismatch

Critical 9.8

In plain English

A critical-severity authentication bypass in Bastillion from bastillion-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 41.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

Affected products (as reported)

Vendor	Product	Versions
bastillion-io	Bastillion	0 – through 5.1.0

Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Issue #669 issue-tracking
https://github.com/bastillion-io/Bastillion product
Fix unauthenticated admin bypass, harden WS terminal auth, add login throttling patch
execute() dispatch in loophole/mvc/base/BaseKontroller.java technical-description
VulnCheck Advisory: Bastillion Authentication Bypass via Path-Prefix Routing Mismatch third-party-advisory