CVE-2026-92087
Description
A flaw was found in @fastify/auth. When composing authentication strategies with the 'or' and 'all' options, and including a nested 'AND' group, the plugin evaluates these strategies in an order-dependent manner. This can cause an earlier failing authentication check to be ignored, resulting in the outcome being determined solely by the last check. Consequently, an attacker with some valid credentials, but lacking full authorization, could bypass intended security restrictions and gain unauthorized access.
Statement
Red Hat has rated this vulnerability as Important because an authenticated remote attacker possessing minimal credentials can circumvent route access controls and gain unauthorized privileges on applications utilizing affected composite authorization rules. While triggering the flaw requires specific nested authentication structures—combining disjunction and conjunction logic—the failure mode completely suppresses prior authorization denials, allowing access based solely on the final check. This elevates the risk to Important, as low-privileged users can bypass intended security boundaries to access restricted operations or sensitive application data.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Varies by Context; Unexpected State
While often just a bug, operator precedence logic errors can have serious consequences if they are used in security-critical code, such as making an authentication decision. The consequences will vary based on the context surrounding the incorrect precedence. In a security decision, violations of integrity or confidentiality are the most likely results. Otherwise, a crash may occur due to the software reaching an unexpected state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
