{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws · updates",
  "home_page_url": "https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026",
  "feed_url": "https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026/feed.json",
  "description": "Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware.",
  "language": "en",
  "_pwn": {
    "slug": "goahead-6-1-1-tls-auth-cgi-flaws-oct-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026#2026-10-26-57c8d1b6",
      "url": "https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026#2026-10-26-57c8d1b6",
      "title": "GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws: FoxIO publishes 'Three TLS Bugs in GoAhead' (CRL bypass, LibreSSL chain-depth bypass, Mbed TLS 1-byte DH modulus) and warns that hundreds of millions of devices embed GoAhead and rarely get updated.",
      "content_text": "GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws: FoxIO publishes 'Three TLS Bugs in GoAhead' (CRL bypass, LibreSSL chain-depth bypass, Mbed TLS 1-byte DH modulus) and warns that hundreds of millions of devices embed GoAhead and rarely get updated.\n\nSource: https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead",
      "date_published": "2026-10-26T00:00:00.000Z",
      "external_url": "https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026#2026-10-12-4e9fdf30",
      "url": "https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026#2026-10-12-4e9fdf30",
      "title": "GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws: Embedthis publishes eleven GoAhead security advisories and the v6.1.1 release (shipped to device builders Aug 2), including critical BF1 auth bypass, OpenSSL CRL non-enforcement and Windows CGI command injection.",
      "content_text": "GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws: Embedthis publishes eleven GoAhead security advisories and the v6.1.1 release (shipped to device builders Aug 2), including critical BF1 auth bypass, OpenSSL CRL non-enforcement and Windows CGI command injection.\n\nSource: https://github.com/embedthis/goahead/releases/tag/v6.1.1",
      "date_published": "2026-10-12T00:00:00.000Z",
      "external_url": "https://github.com/embedthis/goahead/releases/tag/v6.1.1",
      "tags": [
        "critical"
      ]
    }
  ]
}