CVE ID :CVE-2026-107492
Published : Nov. 6, 2026, 12:43 a.m. | 26 minutes ago
Description :Improper Authentication in the jwt_authn HTTP filter in envoyproxy envoy versions up to and including 1.38.0 allows an unauthenticated attacker to bypass JWT requirements by sending a duplicate trigger header. When a JWT requirement is scoped to a specific header, supplying that header twice with any second value causes the requirement to silently not apply, allowing the request to reach the upstream backend without any token check.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
Published : Nov. 6, 2026, 12:43 a.m. | 26 minutes ago
Description :Improper Authentication in the jwt_authn HTTP filter in envoyproxy envoy versions up to and including 1.38.0 allows an unauthenticated attacker to bypass JWT requirements by sending a duplicate trigger header. When a JWT requirement is scoped to a specific header, supplying that header twice with any second value causes the requirement to silently not apply, allowing the request to reach the upstream backend without any token check.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more…