7.5 High

CVE-2024-10295 Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a request

Description

A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorized access to the backend. This issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentication checks and proceed with routing the request upstream.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Red Hat 3scale API Management Platform 2	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2321258 bugzilla.redhat.com

Timeline

Published October 24, 2024
Last modified November 4, 2026

The 65 CVEs of Red Hat 3scale API Management Platform 2 →

CVE-2026-92925 Redis: redis: out-of-bounds read via crafted cluster bus packets 7.1 High CVE-2026-54297 Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters 7.5 High CVE-2026-12143 form-data is a library for creating readable multipart/form-data streams 8.7 High CVE-2026-44486 Axios is a promise based HTTP client for the browser and Node.js 7.5 High

Track this CVE