{"uuid": "7bb0e444-8604-41de-8bb6-fc87d3754bae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52021", "type": "seen", "source": "https://gist.github.com/itsmohitnarayan/e456399f083130962bab6c710f208437", "content": "# CVE-2026-52021: Mobile API Authentication Bypass via Unvalidated Auth-Key Header in code100x/cms\n\n## CVE ID\nCVE-2026-52021\n\n## Affected Product\n- Project: code100x/cms (100xDevs CMS)\n- Repository: https://github.com/code100x/cms\n- Live deployment observed: https://app.100xdevs.com\n- Affected component: `src/middleware.ts` (`withMobileAuth` function), which guards routes matched by `/api/mobile/:path*`, including `src/app/api/mobile/search/route.ts`\n\n## Affected Versions\nObserved on the live deployment of app.100xdevs.com and in the public source tree as of 2026-04-30. Re-verified against the current `main` branch (commit 9f3c8f4) on 2026-08-07; the vulnerable code is unchanged. The last commit to modify `src/middleware.ts` was ff3bda3 (2024-12-07), which did not touch this check.\n\n## Patched Versions\nNone. No fix has been observed in the public repository or the live deployment as of 2026-08-07.\n\n## Vulnerability / Problem Type\nCWE-306: Missing Authentication for Critical Function\n\n## Summary\nThe `withMobileAuth` middleware function that protects mobile API routes under `/api/mobile/:path*` grants access based solely on the presence of an `Auth-Key` request header, without validating its value against any server-side secret:\n\n```typescript\nexport const withMobileAuth = async (req: RequestWithUser) => {\n  if (req.headers.get('Auth-Key')) {\n    return NextResponse.next();\n  }\n  const token = req.headers.get('Authorization');\n  ...\n```\n\nAny request that includes an `Auth-Key` header, regardless of its value, bypasses JWT verification entirely. Downstream route handlers, such as `src/app/api/mobile/search/route.ts`, then trust a client-supplied `g` header to identify the \"authenticated\" user, allowing a caller to forge arbitrary user identity as well.\n\n## Impact\nAn unauthenticated attacker can reach protected mobile API endpoints, including the search endpoint, without a legitimate session or valid credentials, by supplying any arbitrary value in the `Auth-Key` header. This exposes data such as course and video titles and internal content identifiers that should require an authenticated, entitled session.\n\n## Proof of Concept\n```bash\ncurl -i -s \\\n  -H 'Auth-Key: anything' \\\n  -H 'g: {\"id\":\"forged-user\",\"email\":\"forged@example.com\"}' \\\n  'https://app.100xdevs.com/api/mobile/search?q=test'\n```\n\nObserved result (captured 2026-04-30): HTTP 200 OK with a JSON array of search results (course/video titles and IDs), rather than a 401/403 rejection.\n\n## Root Cause\n`withMobileAuth` in `src/middleware.ts` treats the mere presence of the `Auth-Key` header as sufficient authorization and never compares it against a server-side secret before calling `NextResponse.next()`.\n\n## Remediation\nValidate `Auth-Key` against a securely stored server-side secret before bypassing JWT verification, and do not trust a client-supplied `g` header for user identity unless it was set by trusted middleware after successful authentication.\n\n## References\n- Source: https://github.com/code100x/cms/blob/main/src/middleware.ts\n- Source: https://github.com/code100x/cms/blob/main/src/app/api/mobile/search/route.ts\n\n## Disclosure Timeline\n- 2026-04-30: Vulnerability identified and verified against source and live deployment.\n- 2026-08-06: CVE service request submitted (request 2084598).\n- 2026-08-07: Vulnerability re-verified as still present and unpatched on the current main branch.\n\n## Reporter\nSamyora (director@samyora.co)\n", "creation_timestamp": "2026-08-07T14:32:36.606227Z"}