CVE-2021-21335

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Mar 8, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-213366.5Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before versioCVE-2021-213376.1Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before versioCVE-2021-213386.1TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 itCVE-2021-213397.5TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 usCVE-2021-21346.5Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Control Plugin). The suppCVE-2021-213405.4TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that databaCVE-2021-213417.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allCVE-2021-213429.1XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the pCVE-2021-213437.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the pCVE-2021-213449.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may aCVE-2021-213459.9XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may aCVE-2021-213469.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a