CVE-2026-108548 — AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthentic…
Published: 2026-10-10 · CVSS: 6.9 · CVSS 4.0
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7