Description
Neotoma versions starting at v0.6.0 can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present.
Recommendation
Update the neotoma package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.6.0, < 0.11.1
- Patched version(s): 0.11.1
References
Could your website be exposed too?
SmartScanner can check your website for Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header - CVE-2026-39411
- StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check - CVE-2026-32101
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- Axios: no_proxy bypass via IP alias allows SSRF - CVE-2026-42038
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026