CVE-2026-54089: File Browser Authentication Bypass via Proxy Auth Header Forgery
Summary
CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery. Affects github.com/filebrowser/filebrowser/v2 versions >= 2.0.0-rc.1, <= 2.63.18. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-54089 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FileBrowser is an open-source file management tool that allows users to manage files on a server through a web interface. It supports various authentication methods, including proxy authentication, which is commonly used in production environments behind reverse proxies. This configuration, while convenient, can expose the application to serious security risks if not properly secured.
Vulnerability Detail
The vulnerability arises when FileBrowser is configured with proxy authentication (auth.method=proxy). An unauthenticated attacker can impersonate any user, including admin, by sending a forged HTTP header without needing any credentials. This flaw allows attackers to create new user accounts automatically, leading to unauthorized access and potential full control over the application. The core issue lies in the lack of origin validation, password verification, and the automatic creation of user accounts when a non-existent username is provided.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, disable proxy authentication by setting auth.method=json in the configuration. This will prevent the vulnerability from being exploited until a proper fix is applied.
Conclusion
CVE-2026-54089 represents a significant security risk for FileBrowser users who have enabled proxy authentication. By understanding the nature of this vulnerability and applying the recommended fixes or workarounds, users can protect their applications from potential exploitation.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
CVE-2026-54089 is a vulnerability in FileBrowser that allows unauthenticated attackers to bypass authentication via forged HTTP headers when proxy authentication is enabled.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against CVE-2026-54089 using the Vulert playground at Vulert Scanner.
An attacker can gain full admin access, read server settings, enumerate and impersonate users, and create unauthorized accounts, leading to severe security breaches.
Yes, updating to the latest version of FileBrowser will address this vulnerability. Ensure to follow the update instructions provided.
As a temporary measure, disable proxy authentication in your configuration to mitigate the risk until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
