{"data":{"id":"f858b34a-ab09-408b-a7be-8418c0bb4b10","title":"GHSA-94f4-hr76-p5j6: vLLM: OpenAI auth bypass","summary":"GHSA-94f4-hr76-p5j6 is a vulnerability in vLLM's OpenAI-compatible API server that allows authentication bypass of the AuthenticationMiddleware. The flaw stems from starlette reconstructing the URL from an unfiltered Host header on ASGI servers such as uvicorn, letting an attacker control url.path and reach /v1 endpoints without the configured VLLM_API_KEY or --api-key. Instances behind an RFC-conforming web server such as nginx are not affected.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-94f4-hr76-p5j6","publishedAt":"2026-06-16T17:36:41.000Z","cveId":"CVE-2026-48746","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.3.0, < 0.22.0 (fixed: 0.22.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01152,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":["GHSA-94f4-hr76-p5j6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-16T17:36:41.000Z","fixReleasedAt":"2026-05-29T10:32:10.261Z","daysToFix":-18,"fixCheckedAt":"2026-10-29T21:34:32.504Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.22.0","matchedVersion":"0.22.0","fixReleasedAt":"2026-05-29T10:32:10.261Z","daysToFix":-18,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:34:32.359Z"}]}}