CVE-2026-74994

Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1

Description The mod auth module in the inets httpd server collapses all directory configuration blocks into a single shared user/group namespace when configured with dets or mnesia authentication backends. This behavior allows a user authorized for one protected directory to be accepted as valid for all other protected directories on the same server instance.

Recommendations Update OTP to version 27.3.4.17 or later. Update OTP to version 28.5.0.6 or later. Update OTP to version 29.0.6 or later. Update inets to version 9.3.2.7 or later. Update inets to version 9.6.2.3 or later. Update inets to version 9.7.2 or later.