EUVD-2026-275783

fkie_cve-2026-32136

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This vulnerability is fixed in 0.107.73.

GHSA-5fg6-wrq4-w5gh — AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

Affected: Go: github.com/AdguardTeam/AdGuardHome

VULNERABILITY: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass ======================================================================== Severity: CRITICAL CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CWE: CWE-287 (Improper Authentication) Component: internal/home/web.go Affected: AdGuardHome (tested on v0.107.72)

------------------------------------------------------------------------ Summary ------------------------------------------------------------------------

An unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided.

------------------------------------------------------------------------ Root Cause ------------------------------------------------------------------------

In internal/home/web.go (approximately lines 268-283), the HTTP server is constructed as follows: hdlr := h2c.NewHandler( withMiddlewares(web.conf.mux, limitRequestBody), // no auth &http2.Server{}, ) web.httpServer = &http.Server{ Handler: web.auth.middleware().Wrap(hdlr), // auth here }

The authentication middleware wraps the h2c handler at the outer…

Most recent entries from all

EUVD-2026-275783

fkie_cve-2026-32136

GHSA-5fg6-wrq4-w5gh — AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass