CVE-2026-41448

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41448

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41448.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41448

Published

2026-06-08T16:12:56Z

Modified

2026-10-28T02:30:25Z

Severity

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

AdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie

Details

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in the Admin-Token header to redirect file reads to arbitrary paths.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41448.json"
}

References

Affected packages

Git / github.com/adguardteam/adguardhome

Affected ranges

Type

GIT

Repo

https://github.com/adguardteam/adguardhome

Events

Introduced

Fixed

09789cd5d2d68563143a3a66160dc3ecb3cfba40

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.107.77"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "original_tag":  "v0.107.77",
            "range":  [
                {
                    "fixed":  "09789cd5d2d68563143a3a66160dc3ecb3cfba40"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.1

v0.100.0

v0.100.1

v0.100.2

v0.100.3

v0.100.4

v0.100.5

v0.100.6

v0.100.7

v0.100.8

v0.100.9

v0.101.0

v0.102.0

v0.103.0

v0.103.0-beta1

v0.103.0-beta2

v0.103.0-beta3

v0.103.1

v0.103.2

v0.103.3

v0.104.0

v0.104.0-beta1

v0.104.0-beta2

v0.104.0-beta3

v0.104.1

v0.105.0

v0.105.0-beta.3

v0.105.0-beta.4

v0.105.0-beta.5

v0.105.1

v0.105.1-beta.1

v0.105.2

v0.105.2-beta.1

v0.106.0

v0.106.0-b.1

v0.106.0-b.2

v0.106.0-b.3

v0.106.0-b.4

v0.106.0-b.5

v0.107.0

v0.107.0-b.1

v0.107.0-b.10

v0.107.0-b.11

v0.107.0-b.12

v0.107.0-b.13

v0.107.0-b.14

v0.107.0-b.15

v0.107.0-b.16

v0.107.0-b.17

v0.107.0-b.2

v0.107.0-b.3

v0.107.0-b.4

v0.107.0-b.5

v0.107.0-b.6

v0.107.0-b.7

v0.107.0-b.8

v0.107.0-b.9

v0.107.1

v0.107.10

v0.107.11

v0.107.12

v0.107.13

v0.107.14

v0.107.15

v0.107.16

v0.107.17

v0.107.18

v0.107.19

v0.107.2

v0.107.20

v0.107.21

v0.107.22

v0.107.23

v0.107.24

v0.107.25

v0.107.26

v0.107.27

v0.107.28

v0.107.29

v0.107.3

v0.107.30

v0.107.31

v0.107.32

v0.107.33

v0.107.34

v0.107.35

v0.107.36

v0.107.37

v0.107.38

v0.107.39

v0.107.4

v0.107.40

v0.107.41

v0.107.42

v0.107.43

v0.107.44

v0.107.45

v0.107.46

v0.107.47

v0.107.48

v0.107.49

v0.107.5

v0.107.50

v0.107.51

v0.107.52

v0.107.53

v0.107.54

v0.107.55

v0.107.56

v0.107.57

v0.107.58

v0.107.59

v0.107.6

v0.107.60

v0.107.61

v0.107.62

v0.107.63

v0.107.64

v0.107.65

v0.107.66

v0.107.67

v0.107.68

v0.107.69

v0.107.7

v0.107.70

v0.107.71

v0.107.72

v0.107.73

v0.107.74

v0.107.75

v0.107.76

v0.107.8

v0.107.9

v0.9

v0.9-hotfix1

v0.91

v0.92

v0.92-hotfix1

v0.92-hotfix2

v0.93

v0.95

v0.95-hotfix

v0.96

v0.96-hotfix

v0.97.0

v0.97.1

v0.98.0

v0.98.1

v0.99.0

v0.99.1

v0.99.2

v0.99.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41448.json"