HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-108548 — AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the O...

·Source: NIST NVD

Updated:

Executive Summary

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.

Analysis

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user. CVSS Score: 7.3. Published: 2026-10-10T15:16:57.843.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108548
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 10, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

HHS Confirms HIPAA Penalties Will Not Be Adjusted for Inflation This Year

This week, the Department of Health and Human Services (HHS) has confirmed via the Federal Register that it will not […] The post HHS Confirms HIPAA Penalties Will Not Be Adjusted for Inflation This Year appeared first on The HIPAA Journal .

HIPAA Journal
MEDIUMVulnerabilityNEW

Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Affecting the open source calling library RingRTC, the bug prevented calls from ending properly. The post Signal Vulnerability Lets Malicious Callers Block Hang-Ups appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerabilityNEW

Coinbase fined €3.25m by Irish central bank

Crypto exchange Coinbase Ireland has been penalised by the Central Bank of Ireland (CBI) for a series of operational and governance failings over a five-year period.

Finextra