Threats tagged 'ghsa-ghj4-cq25-h326'

Apache bRPC versions prior to 1.18.0 have a missing authentication check in the streaming RPC path. This flaw allows remote attackers to bypass server authentication and inject or deliver streaming frames when the server is configured with an Authenticator. The issue arises because streaming RPC frames bypass the authentication hook and streams can accept frames from unauthorized sockets. The vulnerability is fixed in version 1.18.0.