GHSA-2rx5-2g7j-2659: Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate at lines 109-117 runs. Any holder of a valid Constellation device API key sends x-cosmos-user: admin to a proxied backend; the documented forward-auth integration treats the caller as admin with no JWT cookie, password, or MFA. Preconditions - Cosmos is deployed with Constellation enabled and at least one device enrolled. - Attacker holds a valid x-cstln-auth API key for an enrolled device. - Attacker reaches Cosmos over the Constellation Nebula tunnel. - Target proxy route has AuthEnabled=true; upstream trusts the x-cosmos-user forward-auth header. Details // src/proxy/routerGen.go:46-122 - bypass returns before headers are reset func tokenMiddleware(route utils.ProxyRouteConfig) func(next http.Handler) http.Handler { return func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { enabled := route.AuthEnabled adminOnly := route.AdminOnly // bypass auth if from Constellation tunnel if ((enabled && r.Header.Get("x-cosmos-user") != "") || !enabled) { // attacker-set header opens the branch remoteAddr, _ := utils.SplitIP(r.RemoteAddr) isConstIP := constellation.IsConstellationIP(remoteAddr) isConstTokenValid := constellation.CheckConstellationToken(r) == nil if isConstIP && isConstTokenValid { utils.Debug("Bypassing auth for Constellation tunnel") r.Header.Del("x-cstln-auth") next.ServeHTTP(w, r) // forwards x-cosmos-user as set by attacker return } } r.Header.Del("x-cosmos-user") // only runs on the fall-through path r.Header.Del("x-cosmos-role") r.Header.Del("x-cosmos-user-role") r.Header.Del("x-cosmos-mfa") r.Header.Del("x-cstln-auth") // ... JWT path runs here ... if enabled && adminOnly { if errT := AdminOnlyWit