lanyulei ferry: Improper authentication in JWT validation (CVE-2026-127281)
The lanyulei ferry application versions 1.0.0-beta.1 and 1.0.0 contain a vulnerability in the JWT validation middleware that allows remote, unauthenticated attackers to bypass authentication.
CVE search metadata
CVE search record: CVE-2026-127281. Severity: high. CVSS: 7.3. KEV: no. Product: ferry. Brief: lanyulei ferry: Improper authentication in JWT validation (CVE-2026-127281). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ferry-auth-bypass-cve-2026-127281/
Triage facts
Revision 1- Applicability
- ferry
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 13, 02:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A remote authentication bypass vulnerability (CVE-2026-127281) has been identified in the lanyulei ferry application, specifically within the JWT validation middleware located at middleware/auth.go. The vulnerability affects versions 1.0.0-beta.1 and 1.0.0. While the vendor was contacted, they did not respond to the disclosure. Public exploit code for this vulnerability has been made available.
Impact
Successful exploitation allows a remote attacker to bypass authentication. The CVSS 3.1 base score is 7.3.