CVE-2026-40910: frp: Authentication bypass in HTTP vhost routing with routeByHTTPUser access control

Overview

frp is a fast reverse proxy. According to the GitHub Security Advisory GHSA-pq96-pwvg-vrr9, versions from 0.43.0 up to and including 0.68.0 contain an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. The weakness is classified as CWE-287 (Improper Authentication).

Impact

• An attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may reach a backend protected by httpUser and httpPassword.
• According to the description, this can occur even when the Proxy-Authorization password is incorrect.
• The NVD CVSS base score is 9.1, and the NVD vector lists high confidentiality and integrity impact with no availability impact. GitHub lists a score of 6.5.

Affected products and versions

• Product: Fatedier Frp.
• Affected range: from 0.43.0 up to and including 0.68.0, as stated in the description. The affected-version data uses the boundary before 0.68.1.
• Fixed version: 0.68.1, as stated in the description.
• Only deployments that explicitly use routeByHTTPUser are described as affected. Ordinary HTTP proxy use is described as not affected.
• The fixes field in the record is empty, so the fixed version is taken from the description text and the linked advisory.

Exploitation status

• The record shows no CISA KEV listing. No confirmed exploitation appears in the sources consulted.
• The record lists an SSVC exploitation value of poc (proof of concept) and tags the advisory reference as Exploit. This suggests public exploit material may exist, but it does not confirm active exploitation.

Remediation and mitigation

• Upgrade frp to 0.68.1 or later in every deployment that uses routeByHTTPUser.
• Until the upgrade is complete, do not rely on routeByHTTPUser as the only access control for a protected backend.
• Restrict network reachability of the HTTP vhost entrypoint to trusted networks.
• If exposure is suspected, rotate the httpUser and httpPassword credentials and review access to protected backends.
• Confirm the running version after the upgrade.

Detection guidance

• Review HTTP vhost access logs for requests that carry both Proxy-Authorization and Authorization headers and reach routeByHTTPUser backends.
• Look for successful responses from protected backends that come from unexpected source addresses.
• Correlate authentication failures on the httpUser backend with successful access to the same backend through the routeByHTTPUser path.

Limitations of the available information

• The record contains no proof-of-concept details, no exploitation timeline and no list of observed attacks.
• CVSS scores differ between sources: NVD 9.1 and GitHub 6.5. The record severity field is critical.
• The EPSS entry reports probability 0.00395, percentile 0.32596 and a date of 2026-10-23. The date should be verified before relying on it.
• The mitigation steps above are general defensive guidance and are not drawn from the record.

Frequently asked questions

Which frp versions are affected by this authentication bypass?

The description states that versions from 0.43.0 up to and including 0.68.0 are affected, and only when routeByHTTPUser is used as part of access control.

Is this vulnerability known to be exploited in the wild?

The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted. It does show an SSVC exploitation value of poc and an Exploit tag on the advisory reference.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.