CVE-2026-19863: CWE-288

The vulnerability arises from EthereumAuthenticator's use of an unanchored substring match when checking if a request path corresponds to the configured login path. If a protected resource's path includes the login path as a later segment, the authenticator incorrectly treats the request as targeting the login page, replacing the authentication or role requirement with ALLOWED. This allows unauthenticated clients to access certain protected resources. The issue affects versions >=12.1.0 and <=12.1.12. Explicitly forbidden routes remain unaffected. No known exploits in the wild have been reported.

An unauthenticated attacker can bypass authentication and access protected resources if the resource's path contains the configured login path as a later segment. This could lead to unauthorized access to sensitive data or functionality. The vulnerability does not affect explicitly forbidden routes. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity.

No patch links or vendor advisory details are provided, so patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configuring login paths that may appear as substrings in protected resource paths. Review and adjust routing configurations to prevent the login path from appearing within protected resource URLs. Explicitly forbidden routes are not affected and remain secure.