Is CVE-2026-40910 actively exploited?

No active exploitation of CVE-2026-40910 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40910 be exploited remotely?

Yes. CVE-2026-40910 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40910?

CVE-2026-40910 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-40910

MEDIUM

CVE-2026-40910

CWE-287Published: April 21, 2026· Updated: Apr 22, 2026

6.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.7th

Official Description

frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1.

NVD Source

Technical Analysis

CVE-2026-40910 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.