CVE-2026-108548: AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's authhandler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or userid headers to act as any user.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
AstronRPA versions through 1.1.6 are affected where requests pass through the OpenResty gateway using the vulnerable auth_handler.lua. The affected routes are /api/resource/ and /api/rpa-ai-service/.
What does an attacker need to exploit this issue?
An attacker needs only network access to the gateway; no valid account, credentials, or user interaction is required. They can provide an arbitrary Bearer token and spoof the X-User-Id or user_id header.
What can an attacker do after bypassing authentication?
The attacker can reach the affected API routes and act as any user by supplying a chosen X-User-Id or user_id value. The reported impact includes confidentiality, integrity, and availability effects.
How can I check whether my gateway is vulnerable?
Inspect the OpenResty gateway auth_handler.lua, particularly the authentication handling corresponding to lines 21 through 35 in the referenced 1.1.6 file. A vulnerable implementation accepts arbitrary Bearer token values without validating them and trusts client-supplied X-User-Id or user_id headers.