Authentication bypass in GOautodial API
Priority LOW 35CWE-305Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Why it matters now
EPSS 0.01199 68th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed GOautodial API (GOautodial): 3c3a979
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GOautodial | GOautodial API | before 3c3a979 | 3c3a979 | Patch available | CNA |
- GOautodial API VendorGOautodial Affected before 3c3a979 Fixed in 3c3a979 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:goautodial:goautodial:4:*:*:*:*:*:*:* | 4 | Vulnerable | GOautodial |
| cpe:2.3:a:goautodial:goautodial_api:2:*:*:*:*:*:*:* | 2 | Vulnerable | GOautodial |
- cpe:2.3:a:goautodial:goautodial:4:*:*:*:*:*:*:* Versions 4 Vulnerable ·GOautodial
- cpe:2.3:a:goautodial:goautodial_api:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·GOautodial
Remediation
- Fix · CNA GOautodial API (GOautodial) Fixed in 3c3a979
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43175
- 2026-10-03 Alias added: GHSA-jgjr-5rhg-5c7w
References
More Goautodial vulnerabilities
- TI-2021-19190 Path traversal in GOautodial API CVSS 3.1HIGH 8.8
Sources
- CVE-2021-43175 · CVE Program
- CVE-2021-43175 · NVD
- FIRST EPSS
- GHSA-jgjr-5rhg-5c7w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences