CVE-2026-40910

CVE-2026-40910 is an authentication bypass vulnerability in frp (fast reverse proxy) versions 0.43.0 through 0.68.0 that affects deployments using routeByHTTPUser for access control. The flaw exists in the HTTP vhost routing path where routing logic and authentication validation use different header sources, allowing attackers to bypass password requirements and access protected backends. This issue only impacts systems that explicitly use the routeByHTTPUser feature and does not affect standard HTTP proxies. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector, high complexity, and no privilege or user interaction required. While the attack has limited direct impact, successful exploitation could result in high confidentiality loss and limited integrity compromise to protected backend resources. The attack requires knowledge or guessing of the protected routeByHTTPUser value and network access to the HTTP vhost entrypoint. There is no evidence of active exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. With an EPSS score of 0.000410000 and a FAUCET risk score of 44.0 out of 100, community attention appears minimal. Mitigation is straightforward through immediate upgrade to version 0.68.1 or later.