https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 08:13:44 +0000 https://db.gcve.eu/vuln/cve-2026-92087 <p><strong>Affected:</strong> @fastify/auth</p> <p>@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation &#34;or&#34; option together with the run &#34;all&#34; option and one entry is a nested array acting as an AND group, the group is evaluated in an order-dependent way: an earlier failing check is silently dropped and the group&#39;s result becomes the outcome of its last check. As a result, a request that satisfies only the last member of an AND group, for example an attacker who holds a valid API key but is not an administrator, is authorized instead of rejected, and a related order-dependent bypass affects the mirror configuration where the top-level relation is &#34;and&#34; and a nested group uses &#34;or&#34;. The issue is fixed in @fastify/auth 5.1.1, and users should upgrade to 5.1.1 or later. As a workaround, omit the run &#34;all&#34; option where it is not required, order each AND group so its stricter check is evaluated last, or replace nested AND groups with an explicit top-level &#34;and&#34; composition.</p> <p><strong>Affected:</strong> @fastify/auth</p> <p>@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions 5.0.0 through 5.1.0, when strategies are composed with the relation &#34;or&#34; option together with the run &#34;all&#34; option and one entry is a nested array acting as an AND group, the group is evaluated in an order-dependent way: an earlier failing check is silently dropped and the group&#39;s result becomes the outcome of its last check. As a result, a request that satisfies only the last member of an AND group, for example an attacker who holds a valid API key but is not an administrator, is authorized instead of rejected, and a related order-dependent bypass affects the mirror configuration where the top-level relation is &#34;and&#34; and a nested group uses &#34;or&#34;. The issue is fixed in @fastify/auth 5.1.1, and users should upgrade to 5.1.1 or later. As a workaround, omit the run &#34;all&#34; option where it is not required, order each AND group so its stricter check is evaluated last, or replace nested AND groups with an explicit top-level &#34;and&#34; composition.</p> https://db.gcve.eu/vuln/cve-2026-92087