CVE-2026-90447

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header. An authenticated user with a shared service credential can manipulate this header to bypass the primary role-based authorization check and access an alternate path with a fixed, elevated role. This allows a low-privileged authenticated attacker to perform actions reserved for higher-privileged roles.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.