CVE-2026-74994 in OTP
Summary
by MITRE • 09/01/2026
The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within the mod_auth module of Erlang/OTP's inets HTTP server represents a critical authentication bypass flaw rooted in improper state management and namespace isolation during directory-based access control configuration. When administrators configure multiple protected directories using dets or mnesia as the underlying authentication backends, the system fails to maintain strict separation between these distinct security contexts. Instead of treating each directory block as an isolated environment with its own set of valid credentials, the implementation collapses all configured directory blocks into a single shared user and group namespace. This architectural oversight means that the server does not validate whether a provided username belongs specifically to the requested resource's authorized list but rather checks if the credential exists anywhere within the global pool associated with the inets instance.
From a technical perspective, this flaw allows for unauthorized access through simple credential reuse across different security zones. If an attacker knows valid credentials for one protected directory on the server, those same credentials will be accepted as valid when attempting to access any other protected directory configured on that same server instance. This effectively nullifies the principle of least privilege and compartmentalization intended by multi-directory configurations. The vulnerability is particularly dangerous in environments where different directories serve distinct purposes or contain sensitive data for separate user groups, as it enables lateral movement within the web application's file structure without requiring additional reconnaissance to discover new credentials.
The operational impact of this vulnerability is significant, potentially leading to full unauthorized access to restricted areas of a web server. Attackers can exploit this flaw to bypass authentication mechanisms entirely by leveraging valid accounts from unrelated sections of the site. This could result in data exfiltration, modification of sensitive files, or further exploitation depending on the permissions associated with the reused credentials. The scope of impact is broad because it affects any deployment utilizing multiple directory blocks with dets or mnesia backends, which are common choices for simple file-based authentication setups due to their ease of integration and lack of external database dependencies.
This issue impacts a wide range of Erlang/OTP versions, specifically affecting OTP releases from 17.0 up to but not including 27.3.4.17, as well as the corresponding inets module versions ranging from 5.10 through 9.7.x prior to their respective patch levels. The flaw is present in configurations where multiple directory blocks are defined with authentication enabled using either dets or mnesia backends. It is important for system administrators and developers to verify their current OTP version against the specified safe thresholds before applying any mitigations, as earlier versions may also be susceptible though not explicitly confirmed by the vendor.
To mitigate this vulnerability, organizations must upgrade Erlang/OTP to a patched version immediately. For systems running OTP 17.x through 26.x, an upgrade to at least version 27.3.4.17 is required. Systems on OTP 28.x should be upgraded to version 28.5.0.6 or later, and those on the latest OTP 29.x branch must update to version 29.0.6 or higher. These updates contain fixes that enforce proper namespace isolation between directory blocks, ensuring that credentials are validated against the specific backend associated with each protected path rather than a global pool. Until upgrades can be performed, administrators should consider restricting access via network-level controls such as firewalls or reverse proxies to limit exposure of vulnerable endpoints, although this is not a substitute for patching the underlying application logic flaw.
In terms of industry standards and classification frameworks, this vulnerability aligns with CWE-280: Improper Handling of Insufficient Permissions Privileges, specifically regarding the failure to enforce access control policies across different security contexts. It also relates closely to CWE-640: Weak Password Recovery Mechanism for Forgotten Password if the shared namespace allows users to reset passwords in one area and gain access elsewhere. From an offensive security perspective, this flaw facilitates privilege escalation within a single application instance and can be categorized under ATT&CK technique T1078: Valid Accounts, as it involves the misuse of legitimate credentials that are valid for other parts of the system but not necessarily authorized for the specific target resource. Proper remediation requires strict adherence to version updates and rigorous testing of multi-directory authentication configurations post-upgrade to ensure isolation is correctly enforced.