GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws ยท updates https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026 Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware. en Mon, 26 Oct 2026 00:00:00 GMT GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws: FoxIO publishes 'Three TLS Bugs in GoAhead' (CRL bypass, LibreSSL chain-depth bypass, Mbed TLS 1-byte DH modulus) and warns that hundreds of millions of devices embed GoAhead and rarely get updated. https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026 https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026#2026-10-26-57c8d1b6 Mon, 26 Oct 2026 00:00:00 GMT critical <p><a href="https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead">Source</a></p> GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws: Embedthis publishes eleven GoAhead security advisories and the v6.1.1 release (shipped to device builders Aug 2), including critical BF1 auth bypass, OpenSSL CRL non-enforcement and Windows CGI command injection. https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026 https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026#2026-10-12-4e9fdf30 Mon, 12 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/embedthis/goahead/releases/tag/v6.1.1">Source</a></p>