Basic Authentication can be bypassed using a malformed username
Priority MEDIUM 45CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.
Why it matters now
EPSS 0.0166 76th percentileScored 2026-11-07
Fix Fixed spnego-http-auth-nginx-module (stnoonan): 1.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| stnoonan | spnego-http-auth-nginx-module | before 1.1.1 | 1.1.1 | Patch available | CNA |
- spnego-http-auth-nginx-module Vendorstnoonan Affected before 1.1.1 Fixed in 1.1.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:spnego_http_authentication_module_project:spnego_http_authentication_module:*:*:*:*:*:nginx:*:* | before 1.1.1 | Vulnerable | Spnego Http Authentication Module Project |
- cpe:2.3:a:spnego_http_authentication_module_project:spnego_http_authentication_module:*:*:*:*:*:nginx:*:* Versions before 1.1.1 Vulnerable ·Spnego Http Authentication Module Project
Remediation
- Fix · CNA spnego-http-auth-nginx-module (stnoonan) Fixed in 1.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21335
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences