Most recent entries from all

EUVD-2026-368634

fkie_cve-2026-49446

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.

GHSA-2rx5-2g7j-2659 — Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Affected: Go: github.com/azukaar/cosmos-server

### Summary

The Constellation-tunnel bypass branch in `tokenMiddleware` at `src/proxy/routerGen.go:53-66` returns to the upstream handler before the request's `x-cosmos-user`, `x-cosmos-role`, `x-cosmos-user-role`, and `x-cosmos-mfa` headers are stripped at lines 68-72, and before the `AdminOnlyWithRedirect` gate at lines 109-117 runs. Any holder of a valid Constellation device API key sends `x-cosmos-user: admin` to a proxied backend; the documented forward-auth integration treats the caller as admin with no JWT cookie, password, or MFA.

### Preconditions

- Cosmos is deployed with Constellation enabled and at least one device enrolled. - Attacker holds a valid `x-cstln-auth` API key for an enrolled device. - Attacker reaches Cosmos over the Constellation Nebula tunnel. - Target proxy route has `AuthEnabled=true`; upstream trusts the `x-cosmos-user` forward-auth header.

### Details

```go // src/proxy/routerGen.go:46-122 - bypass returns before headers are reset func tokenMiddleware(route utils.ProxyRouteConfig) func(next http.Handler) http.Handler { return func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { enabled := route.AuthEnabled adminOnly := route.AdminOnly

// bypass auth if from Constellation tunnel if ((enabled && r.Header.Get("x-cosmos-user") != "") || !enabled) { // attacker-set header opens the branch remoteAddr, _ := utils.…