CVE-2026-49446

Name of the Vulnerable Software and Affected Versions Cosmos-Server (affected versions not specified)

Description An authentication bypass exists in the tokenMiddleware function within src/proxy/routerGen.go. The issue occurs when the Constellation-tunnel bypass branch is triggered, causing the application to return to the upstream handler before stripping critical identity headers and before executing the AdminOnlyWithRedirect() gate.

An attacker possessing a valid x-cstln-auth API key for an enrolled device can bypass JWT login, password, and MFA requirements by sending a request through the Constellation Nebula tunnel with a manually set x-cosmos-user header (e.g., x-cosmos-user: admin). Because the bypass branch is entered before the headers are reset, the proxied backend receives the attacker-controlled identity. This allows the attacker to impersonate any user, including administrators, and gain unauthorized access to admin-only proxied backends.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

As a temporary mitigation, restrict the use of the x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers by ensuring they are stripped or validated at the backend level, and avoid trusting these headers over untrusted hops.