Περιγραφή
Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header to disable limited key scoping and execute requests using the main API key context instead of restricted subkey permissions.
CVSS 6.4EPSS 0.345%Κίνδυνος 0.66
Προβολή πηγής- Δημοσίευση
- 2026-06-22 22:16:51
- Επηρεαζόμενες εκδόσεις
- <12.128.2
- Τύπος
- Κρίσιμο λογισμικό
- Διάνυσμα
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N