An unauthenticated remote attacker can bypass all authentication in AdGuard Home by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner multiplexer, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This flaw is identified as CWE‑287 and allows an attacker to gain full administrative control of the service.

The vulnerability affects all installations of AdGuard Home running versions earlier than 0.107.73. The affected vendor is AdguardTeam:AdGuardHome, and the generic CPE identifier is cpe:2.3:a:adguard:adguardhome:*:*:*:*:*:*:*:.

The CVSS score of 9.8 classifies this as a critical vulnerability, while the EPSS score of less than 1% indicates a relatively low current exploitation probability. This flaw is not listed in the CISA KEV catalog. The likely attack vector is a remote, unauthenticated network attacker who can send a crafted HTTP/1.1 upgrade request to an internet‑facing AdGuard Home instance. Exploitation would give the attacker unrestricted administrative access to the service without any valid credentials.