A security vulnerability, cataloged as CVE-2026-48710, has been identified in the Starlette web framework. The vulnerability, reported by BadHost, involves an authentication bypass mechanism that can be triggered by manipulating the HTTP Host header.
This issue affects applications built using Starlette that rely on the Host header for authentication or access control. Attackers could potentially exploit this by sending a crafted Host header to gain unauthorized access to restricted resources or functionalities within a vulnerable application.
Details of the vulnerability have been made public, allowing developers to assess their systems and implement necessary patches or workarounds. The Starlette project maintainers are expected to address this issue in future updates.
