Vulnerabilities in pkg:npm/@acastellon/auth
PACKAGECVE-2026-58399 is a CRITICAL authentication bypass vulnerability (CWE-290: Authentication Bypass by Spoofing) affecting @acastellon/auth libraries in the npm ecosystem. The issue involves authentication bypass via spoofable headers in validatetoken(). Remediation is available by upgrading affected packages to version 2.3.0.
pkg:npm/@acastellon/auth
Vulnerability advisories affecting package pkg:npm/@acastellon/auth. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-gfj5-979r-92pw | CVE-2026-58399 | CRITICAL | @acastellon/auth: Authentication bypass via spoofable headers in validateToken() |
CVE-2026-58399 at a Glance
How to Fix CVE-2026-58399
To remediate this vulnerability, upgrade all affected @acastellon/auth dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @acastellon/auth@2.3.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @acastellon/authHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-58399, inspect your project dependencies using npm:
npm ls @acastellon/authAnalyze the terminal output to locate any version of @acastellon/auth in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.3.0), your application is affected.
Note: The npm ls @acastellon/auth command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-290: Authentication Bypass by Spoofing, where this attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. In @acastellon/auth, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-58399 Affected @acastellon/auth Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@acastellon/auth
|
npm |
< 2.3.0
|
2.3.0
|
References
Frequently Asked Questions
What is CVE-2026-58399?
Which @acastellon/auth versions are affected?
What version fixes CVE-2026-58399?
Is @acastellon/auth affected?
What CWE is associated with CVE-2026-58399?
How can I check npm dependencies for CVE-2026-58399?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-gfj5-979r-92pw",
"modified" : "2026-07-01T14:30:32Z",
"published" : "2026-06-18T17:22:47Z",
"aliases" : [ "CVE-2026-58399" ],
"summary" : "@acastellon/auth: Authentication bypass via spoofable headers in validateToken()",
"details" : "@acastellon/auth v2.2.0 appears to allow an unauthenticated authentication bypass in validateToken() through spoofable auth-user and Host request headers.\n\nThe validateToken middleware contains a service-to-service bypass for auth-user: service-brother when req.get('host').startsWith(getHostName()). Both values involved in the check can be influenced by an unauthenticated HTTP client: auth-user is a request header, and Host is also client-controlled. As a result, a remote unauthenticated attacker can send a request with crafted headers and bypass token validation before the normal legacy/JWT/OIDC validation logic runs.\n\nImpact:\nAn attacker may be able to access routes protected by validateToken() without a valid token. In deployments where downstream services trust auth-user or is-* headers, this may also lead to privilege escalation.\n\nAffected package:\n@acastellon/auth v2.2.0\n\nAffected code:\nauth.js, validateToken()\nThe issue is related to the service-brother bypass and getHostName() check.\n\nExample request:\n```\nGET /protected HTTP/1.1\nHost: <configured CNAME or hostname>\nauth-user: service-brother\nis-admin: true\n```\n\nExpected behavior:\nThe request should require a valid authentication token.\n\nActual behavior:\nThe middleware calls next() before token validation.\n\nFix implemented in v2.3.0+:\n\nRemoved the spoofable bypass.\nAlways sanitize incoming auth-user and is-* headers.\nAdded mTLS client certificate based service auth (with optional TRUSTED_MTLS_SERVICES allowlist).\nUpdated consumers (rest, graphql, dns-client) for mTLS support.\nUnit tests added for sanitization + mTLS path.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@acastellon/auth"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.3.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/antonio-castellon/module-auth/security/advisories/GHSA-gfj5-979r-92pw"
}, {
"type" : "WEB",
"url" : "https://github.com/antonio-castellon/module-auth/issues/6"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/antonio-castellon/module-auth"
}, {
"type" : "WEB",
"url" : "https://www.npmjs.com/package/@acastellon/auth/v/2.3.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-290" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-18T17:22:47Z",
"nvd_published_at" : null
}
}