CVE-2026-108548

{
  "etk_id": "ETK-2026-1177",
  "cve_id": "CVE-2026-108548",
  "display_id": "CVE-2026-108548",
  "ghsa_id": "GHSA-fh8f-pxvw-9f29",
  "euvd_id": "EUVD-2026-96343",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Bearer-token authentication bypass in AstronRPA gateway",
  "summary": "AstronRPA through 1.1.6 has an authentication bypass in its OpenResty gateway. An unauthenticated attacker who can reach affected API endpoints may impersonate users by presenting an unvalidated bearer token and supplying identity-related request headers.",
  "mitigation": "Restrict access to the affected gateway API routes to trusted networks and enforce bearer-token validation at an upstream proxy or identity layer. Update when the vendor publishes a corrected release; the evidence does not identify a fixed version.",
  "vendor": "iflytek",
  "product": "astron-rpa",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.1.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "astron-rpa",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": 0.0029,
  "epss_percentile": 0.2064,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 72.58716683333333,
  "t0_at": "2026-10-10T14:35:03.690000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-10T14:35:03.690000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T14:35:03.690000+00:00",
      "url": "https://github.com/advisories/GHSA-fh8f-pxvw-9f29"
    }
  }
}