Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

Description

Neotoma versions starting at v0.6.0 can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present.

Recommendation

Update the neotoma package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.6.0, < 0.11.1
• Patched version(s): 0.11.1

References

• GHSA-5cvp-p7p4-mcx9
• CVE-2026-45577
• CWE-288
• CWE-306
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header - CVE-2026-39411
• Strapi Upload Plugin MIME Validation Bypass via Content API - CVE-2026-22707
• @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck - CVE-2026-39397
• ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API - CVE-2026-33888

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

neotoma