Improper authentication in Apache bRPC permits an unauthenticated attacker to bypass authentication for protected non‑builtin HTTP endpoints by sending a builtin HTTP request as the first message on an HTTP/1.1 keep‑alive connection. The vulnerability arises when ServerOptions.auth is enabled and builtin services are exposed on a public listener, allowing the connection to be marked as authenticated for subsequent requests. This results in unauthorized access to resources that require authentication.

Apache bRPC from the Apache Software Foundation is affected. Versions up to and including 1.17.0 are vulnerable; the issue is fixed in version 1.18.0. Users of 1.16.x, 1.17.0 and earlier should apply the fix.

The vulnerability is remotely exploitable with an unauthenticated attacker who can initiate a keep‑alive HTTP/1.1 session. The CVSS score of 9.1 indicates critical severity; the EPSS score is <1%, and it is not listed in CISA KEV. The would‑be attacker must have access to the public listener and server options that enable authentication. This is a remote authentication bypass with moderate to high potential impact if credentials protect sensitive data or services.