CVE-2021-21335

KRITISCH 9.8CVE-2021-21335 · Published 08/03/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-21335 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in spnego http authentication module (spnego http authentication module project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.7%, höher als bei 76.8% aller Schwachstellen.
Abhilfe: auf 1.1.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
spnego http authentication module spnego_http_authentication_module_project	`< 1.1.1`	`1.1.1`

Description

In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.

References

stnoonan/spnego-http-auth-nginx-module commit a06f9ef · Patch
stnoonan/spnego-http-auth-nginx-module release v1.1.1 · Third Party Advisory
stnoonan/spnego-http-auth-nginx-module security advisory · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free