CVE-2026-0650 describes an authentication bypass vulnerability in OpenFlagr Flagr's HTTP middleware in versions prior to and including 1.1.18. The issue arises from improper handling of path normalization within the whitelist logic, enabling attackers to craft requests that circumvent authentication controls. This allows unauthorized access to protected API endpoints, potentially leading to modification of feature flags and unauthorized export of sensitive information. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function) and CWE-425 (Direct Request ('Forced Browsing')).

Exploitation of this vulnerability allows unauthenticated attackers to bypass authentication mechanisms and gain unauthorized access to protected API endpoints. This can result in unauthorized modification of feature flags, which may alter application behavior, and unauthorized export of sensitive data. The high CVSS score (9.3) reflects the critical nature of the vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints through network controls or other compensating controls to prevent unauthorized access. Monitor vendor communications for updates regarding an official fix.