The vulnerability arises when the application copies client‑controlled headers and forwards them to backend services without validation. An attacker can inject headers such as x‑trusted‑user during connect, refresh, subscribe, publish, RPC, or proxy calls, which backends may use for authentication or authorization. This type of vulnerability is identified as CWE‑290. This allows an attacker to impersonate legitimate users or otherwise bypass security controls that rely on those headers, resulting in unauthorized access or privilege escalation.

The issue affects the Centrifugo real‑time messaging server released by centrifugal:centrifugo before version 6.9.0. Any installation that accepts client‑provided headers and forwards them to HTTP or gRPC backends is exposed. The problem exists for all API endpoints that call proxy or unidirectional gRPC transports, including connect, refresh, subscribe, publish, RPC, and related proxy calls.

The CVSS score of 9.1 indicates high severity. Exploitation requires only remote access to the server API; the attacker does not need special privileges or additional infrastructure. The exploit can be performed by sending a forged header in a normal client request and does not depend on transport‑level header manipulation. EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and lack of client‑side restrictions make this a significant threat.