MEDIUM6.1Go
GHSA-2rx5-2g7j-2659· CVE-2026-49446, GO-2026-6123Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel
Modified: 8/18/2026
package
Go/github.com/azukaar/cosmos-server
pkg:go/github.com/azukaar/cosmos-server
MEDIUM5.3Go
GHSA-5fqm-cc34-fcf5· CVE-2026-49447, GO-2026-6124Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
Modified: 8/18/2026
—Go
GO-2026-6123· CVE-2026-49446, GHSA-2rx5-2g7j-2659Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel in github.com/azukaar/cosmos-server
Modified: 8/18/2026
—Go
GO-2026-6124· CVE-2026-49447, GHSA-5fqm-cc34-fcf5Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens in github.com/azukaar/cosmos-server
Modified: 8/18/2026