frp, a fast reverse proxy, contains an authentication bypass in its HTTP vhost routing path when the "routeByHTTPUser" feature is enabled. The routing layer selects the backend based on the username supplied in the Proxy-Authorization header, while the access control check verifies credentials from the normal Authorization header. As a result, an attacker who can reach the HTTP vhost entry point and knows or can guess the protected routeByHTTPUser value can access a backend protected by httpUser/httpPassword even when the Proxy-Authorization password is incorrect, effectively bypassing authentication. This flaw is a core authentication bypass (CWE‑287) and compromises the confidentiality and integrity of services exposed through the affected proxy. Affected instances are fatedier:frp versions 0.43.0 through 0.68.0 when the routeByHTTPUser option is used. Deployments that do not enable this feature are not affected. Any organization running a frp instance that exposes the HTTP vhost endpoint must verify the version and review usage of "routeByHTTPUser". The vulnerability carries a moderate CVSS score of 6.5; its EPSS score is currently unavailable and it is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring an attacker to send crafted HTTP requests to the vhost entry point and supply an incorrect Proxy-Authorization token while guessing the routeByHTTPUser value. Because the flaw does not require privileged access on the host, the risk is presented to any remote party with network reachability to the frp server.

The affected product is fatedier:frp. Versions 0.43.0 through 0.68.0 are vulnerable when the "routeByHTTPUser" feature is enabled. Ordinary HTTP proxies that do not use this feature are not impacted.

The CVSS score of 6.5 indicates a moderate impact; the absence of an EPSS score means current exploitation probability is unknown, but this is a non‑zero risk. The vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited by remote attackers with network access to the frp server, who can craft HTTP requests targeting the vhost entry point and use a guessed or known routeByHTTPUser value to access protected backends without the correct Proxy-Authorization credentials. No host‑level privileges or local access are required for exploitation, making the threat relevant to any remote attacker that can reach the server.