CVE-2026-21881
CRITICALKanboard < 1.2.49 - Unauthenticated Authentication Bypass via Spoofed HTTP Header
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-21881. PoCs published by HUSEYNKHANLI.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-21881, an authentication bypass vulnerability in Kanboard when REVERSE_PROXY_AUTH is enabled. The exploit demonstrates how an attacker can impersonate any user by spoofing HTTP headers, with both Python and Bash scripts provided.
Description
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.
Exploits (1)
This repository contains a functional exploit for CVE-2026-21881, an authentication bypass vulnerability in Kanboard when REVERSE_PROXY_AUTH is enabled. The exploit demonstrates how an attacker can impersonate any user by spoofing HTTP headers, with both Python and Bash scripts provided.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N