https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T22:10:09.868266+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-275783 EUVD-2026-275783 2026-10-05T22:10:09.918766+00:00 EUVD-2026-275783 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32136 fkie_cve-2026-32136 2026-10-05T22:10:09.918809+00:00

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This vulnerability is fixed in 0.107.73.

 https://cve.radiocsirt.org/vuln/ghsa-5fg6-wrq4-w5gh GHSA-5fg6-wrq4-w5gh — AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass 2026-10-05T22:10:09.918845+00:00

Affected: Go: github.com/AdguardTeam/AdGuardHome

VULNERABILITY: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass ======================================================================== Severity:  CRITICAL CVSS 3.1:  9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CWE:       CWE-287 (Improper Authentication) Component: internal/home/web.go Affected:  AdGuardHome (tested on v0.107.72)

------------------------------------------------------------------------ Summary ------------------------------------------------------------------------

An unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided.

------------------------------------------------------------------------ Root Cause ------------------------------------------------------------------------

In internal/home/web.go (approximately lines 268-283), the HTTP server is constructed as follows:     hdlr := h2c.NewHandler(         withMiddlewares(web.conf.mux, limitRequestBody),  // no auth         &http2.Server{},     )     web.httpServer = &http.Server{         Handler: web.auth.middleware().Wrap(hdlr),        // auth here     }

The authentication middleware wraps the h2c handler at the outer…