CVE-2026-127281: lanyulei ferry JWT Validation auth.go improper authentication
A vulnerability was found in lanyulei ferry 1.0.0-beta.1/1.0.0. Affected is an unknown function of the file middleware/auth.go of the component JWT Validation. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and requires no privileges or user interaction. Public exploit code is available, which may lower the effort needed for exploitation.
Which releases are identified as affected?
The affected releases listed are lanyulei ferry 1.0.0-beta.1 and 1.0.0. The issue is in JWT validation handling in middleware/auth.go.
Is a vendor fix available?
No vendor response or fix is described in the available data. The vendor was contacted before disclosure but did not respond.