CVE-2026-0650

CVE-2026-0650 is a critical authentication bypass vulnerability affecting OpenFlagr versions up to and including 1.1.18. Due to improper path normalization in the HTTP middleware's whitelist logic, unauthenticated attackers can craft requests to bypass security controls and access protected API endpoints. This unauthorized access could lead to the modification of feature flags and the export of sensitive data, posing a significant risk to data confidentiality and integrity. The vulnerability carries a CVSSv4 score of 9.3 (CRITICAL), indicating a severe threat with a network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No user interaction is required for exploitation. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness at this time.