CVE-2021-21335

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
stnoonan	spnego-http-auth-nginx-module	< 1.1.1

References

https://github.com/stnoonan/spnego-http-auth-nginx-module/commit/a06f9efca373e25328b1c53639a48decd0854570Patch, Third Party Advisory
https://github.com/stnoonan/spnego-http-auth-nginx-module/releases/tag/v1.1.1Third Party Advisory
https://github.com/stnoonan/spnego-http-auth-nginx-module/security/advisories/GHSA-ww8q-72rx-hc54Patch, Third Party Advisory
https://github.com/stnoonan/spnego-http-auth-nginx-module/commit/a06f9efca373e25328b1c53639a48decd0854570Patch, Third Party Advisory
https://github.com/stnoonan/spnego-http-auth-nginx-module/releases/tag/v1.1.1Third Party Advisory
https://github.com/stnoonan/spnego-http-auth-nginx-module/security/advisories/GHSA-ww8q-72rx-hc54Patch, Third Party Advisory

Timeline

Published: Mar 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-213366.5Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before versio CVE-2021-213376.1Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before versio CVE-2021-213386.1TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it CVE-2021-213397.5TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 us CVE-2021-21346.5Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Control Plugin). The supp CVE-2021-213405.4TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that databa CVE-2021-213417.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may all CVE-2021-213429.1XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the p CVE-2021-213437.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the p CVE-2021-213449.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a CVE-2021-213459.9XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a CVE-2021-213469.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a