CVE-2026-48710, aka "BadHost": FastAPI Header-based Auth Bypass

Last Updated: 2026-05-26T20:52:48Z

What’s Happening

A single character injected into the HTTP Host header bypasses path-based authorization in Starlette, the routing core of FastAPI.
X41 has published a scanner, Semgrep rules, and CodeQL queries at Github.com/x41sec/poc/tree/master/starlette-host-header

Actions

There are mitigation and upgrades available, and some design considerations to use a reverse proxy that rejects malformed Host Headers ahead of the ASGI-served applications. Details at the advisory.

A scanner has been released to determine if a given internet-facing server is vulnerable.

Notes

Ars Technica picked up the story.