Skip to content
Threat Feed
Subscribe

Product

Backpropagate (>= 1.1.0, < 1.2.0)

1 brief RSS
critical advisory

Unauthenticated Access to backpropagate UI via Authentication Bypass (CVE-2026-48797)

An authentication bypass vulnerability in `backpropagate` versions >= 1.1.0 and < 1.2.0 allows unauthenticated attackers to gain full control over the Reflex web UI, even when HTTP Basic authentication is ostensibly enabled via the `--auth` flag, permitting data exfiltration, arbitrary training runs, HuggingFace Hub push, disk-fill DoS, and sensitive path discovery.

backpropagate +1 authentication-bypass critical-vulnerability supply-chain data-exfiltration denial-of-service web-ui machine-learning reflex
7t 1c 3i