Is CVE-2026-108548 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108548?

CVE-2026-108548 has a CVSS v3 severity of HIGH (7.3).

Back

CVE-2026-108548

Description

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.