The @acastellon/auth module contains a flaw in its validateToken() middleware that allows a remote attacker to bypass authentication without presenting a valid token. By sending a request that includes an auth‑user header set to the value service‑brother and a Host header that begins with the service’s own hostname, the middleware short‑circuits the normal legacy/JWT/OIDC validation logic. The flaw is identified as CWE‑287 and grants attackers the ability to impersonate any user the service would normally trust.

Deployments of the antonio‑castellon:module‑auth package with a version earlier than 2.3.0. These instances are vulnerable whenever they process HTTP requests from clients that have not already been authenticated. Updating to version 2.3.0 or newer removes the vulnerable header validation code.

The flaw has a CVSS score of 8.7, indicating high severity. The EPSS score is less than 1%, suggesting that exploitation is currently uncommon, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability can be leveraged by any entity that can send arbitrary HTTP requests to the affected microservice, forging the auth‑user and Host headers to bypass token checking. This attack requires only network reachability to the service.