The mod_auth module of Erlang OTP’s inets HTTP server contains a flaw that collapses separate directory authentication namespaces into a single shared namespace when using dets or mnesia backends and multiple directory blocks. As a result, a user that is legitimate in one protected directory becomes implicitly authorized for every other protected directory on the same server instance, effectively bypassing authentication. This flaw permits unauthorized users to access content or services that should be protected, leading to confidentiality and integrity violations.

Vulnerable Erlang OTP releases include 17.0 through 27.3.4.16, 28.0 through 28.5.0.5, and 29.0 through 29.0.5, corresponding to inets versions from 5.10 up to 9.3.2.6, 9.4 up to 9.6.2.2, and 9.7 up to 9.7.1. Versions from OTP 27.3.4.17 onwards, OTP 28.5.0.6 onwards, and OTP 29.0.6 onwards are patched, as are inets 9.3.2.7 and later. The status of releases prior to OTP 17.0 is unknown.

The vulnerability has a CVSS score of 6.0, indicating moderate severity. The EPSS score of 0.364% demonstrates that exploitation probability is low but nonzero. It is not listed in the CISA KEV catalog. The flaw can likely be exploited by sending HTTP requests to any protected directory while the server is configured with dets or mnesia backends, allowing an attacker to gain privileged access without valid credentials. If an attacker has network reach to the server, the risk is substantial; however, the lack of publicly disclosed exploitation reduces immediate concern.