AdGuard Home, when started with the --glinet flag, contains an authentication bypass that allows an unauthenticated attacker to supply a path traversal sequence in the Admin-Token cookie or header. The flaw arises from unsanitized string concatenation used when constructing the token file path within the authglinet middleware, enabling the attacker to redirect file reads to arbitrary paths. This vulnerability can lead to full administrative control over the application without the need to supply valid credentials.

The issue affects the AdGuardHome product from AdguardTeam. It applies to any deployment that enables the deprecated --glinet authentication mode; no specific release version is limited, so all installations configured with this flag are vulnerable.

The CVSS score of 9.2 classifies the flaw as critical. An attacker only needs to send an HTTP request containing a crafted Admin-Token header; no prior authentication is required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so while the likelihood of exploitation is uncertain, the potential impact is high and the attack can be performed remotely over the network.