CVEvulnerability
CVE-2021-21335
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-03-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.
Affected configurations
• spnego http authentication module project spnego http authentication module (< 1.1.1)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://github.com/stnoonan/spnego-http-auth-nginx-module/commit/a06f9efca373e25328b1c53639a48decd0854570 Patch, Third Party Advisory
- https://github.com/stnoonan/spnego-http-auth-nginx-module/releases/tag/v1.1.1 Third Party Advisory
- https://github.com/stnoonan/spnego-http-auth-nginx-module/security/advisories/GHSA-ww8q-72rx-hc54 Patch, Third Party Advisory
- https://github.com/stnoonan/spnego-http-auth-nginx-module/commit/a06f9efca373e25328b1c53639a48decd0854570 Patch, Third Party Advisory
- https://github.com/stnoonan/spnego-http-auth-nginx-module/releases/tag/v1.1.1 Third Party Advisory
- https://github.com/stnoonan/spnego-http-auth-nginx-module/security/advisories/GHSA-ww8q-72rx-hc54 Patch, Third Party Advisory