CVE-2026-45567: 
Roxy-WI vulnerability analysis and mitigation

CVE-2026-45567 is an authentication bypass vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw exists in versions 8.2.6.4 and prior, allowing unauthenticated remote attackers to bypass authentication by including the substring api anywhere in the request URL, or by directly accessing the unauthenticated /api/gpt endpoint. It was published on June 10, 2026, and carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory). At the time of publication, no patches are available (GitHub Advisory).

The root cause is a flawed before_request hook in app/login.py (lines 13–32) that skips authentication whenever the substring api appears anywhere in request.url — including the query string, hostname, or path — rather than checking against an explicit allowlist of public endpoints (CWE-287, CWE-306, CWE-697) (GitHub Advisory). A secondary issue is that the /api/gpt route is registered directly on the Flask app object (not on the api blueprint), so the blueprint's own before_request authentication gate never runs for it, and the route has no @jwt_required decorator. Additionally, a missing comma between 'smon.get_check_status' and 'api' in the allowed endpoints tuple causes Python's adjacent-string-literal concatenation to merge them into 'smon.get_check_statusapi', meaning 'api' is never actually in the allowlist as intended. An attacker can bypass authentication on any route by appending ?api=1 (or any query parameter containing api) to the URL, or can directly POST to /api/gpt without any credentials (GitHub Advisory).

Exploitation of the /api/gpt endpoint allows unauthenticated attackers to reach the GPT handler, causing cost amplification by consuming the operator's GPT quota at roxy-wi.org, leaking the instance's license key via the upstream payload, and generating outbound fingerprinting traffic from the victim's egress IP (GitHub Advisory). The broader URL-substring bypass creates a systemic risk: any existing or future @app.route that omits @jwt_required becomes silently unauthenticated, potentially exposing sensitive management functions for HAProxy, Nginx, Apache, and Keepalived servers. The scope is marked as Changed in CVSS, reflecting that a successful bypass can affect resources beyond the vulnerable component itself (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Roxy-WI instances (version ≤ 8.2.6.4) using search engines like Shodan or Censys, or by browsing to the Roxy-WI login page and checking version indicators.
2. Direct unauthenticated access to /api/gpt: Send a POST request directly to the /api/gpt endpoint without any authentication headers:

   curl -s -o /dev/null -w '/api/gpt → HTTP %{http_code}\n' \
     -X POST http://victim.example/api/gpt \
     -H 'Content-Type: application/json' -d '{"prompt":"x"}'

   A non-302 response confirms the handler is reached without authentication.
3. Authentication bypass on protected routes: Append ?api=1 (or any query parameter containing the string api) to any normally-protected URL to skip the before_request authentication check:

   curl -s -o /dev/null -w '/overview/?api=1 → HTTP %{http_code}\n' \
     'http://victim.example/overview/?api=1'

4. Exploit accessible functionality: With authentication bypassed, interact with any route that lacks its own @jwt_required decorator to enumerate server configurations, extract sensitive data, or manipulate managed services (HAProxy, Nginx, Apache, Keepalived).
5. License key extraction: Observe outbound requests from the server to https://roxy-wi.org/api/gpt which include the operator's license key in the payload, enabling key harvesting via network interception or server-side logging (GitHub Advisory).

• Network: Unauthenticated POST requests to /api/gpt from external IPs; HTTP requests to any Roxy-WI path containing api in the query string (e.g., ?api=1, ?x=apitest) without a preceding authenticated session; unexpected outbound connections from the Roxy-WI host to https://roxy-wi.org/api/gpt.
• Logs: Web server access logs showing POST /api/gpt returning non-302 HTTP status codes from unauthenticated sources; requests to protected routes (e.g., /overview/, /settings/) with api in the query string returning 200/500 instead of 302 redirects to /login.
• Application Behavior: Unexpected GPT API quota consumption on the roxy-wi.org account associated with the license key; repeated 500 errors on /api/gpt from external IPs (indicating the handler is reached but the upstream GPT service is unavailable or rate-limiting) (GitHub Advisory).

No official patch is available as of the publication date (June 10, 2026) (GitHub Advisory). The advisory recommends two manual code-level mitigations: (1) replace the substring-based URL check in app/login.py with an explicit endpoint allowlist using request.blueprint == 'api' and a defined PUBLIC_ENDPOINTS set; and (2) add @jwt_required() to the /api/gpt route or move it onto the api blueprint where the existing authentication gate applies. As an immediate operational workaround, administrators should restrict access to the Roxy-WI interface via network-level controls (firewall rules, VPN, or reverse proxy authentication) to prevent unauthenticated external access until a patched version is released.

The vulnerability was discovered and reported by Vishal Shukla (@shukla304) and the Sechub.dev AI Agent, and published as a GitHub Security Advisory (GHSA-4fcm-qgg8-w2vf) on May 15, 2026 (GitHub Advisory). No significant vendor statements, broader media coverage, or notable community discussion beyond the advisory itself has been identified at this time.