WIMOOR - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/wimoor/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 18:50:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in WIMOOR via Unsigned X-USERINFO Headerhttps://feed.craftedsignal.io/briefs/2026-10-wimoor-auth-bypass/Fri, 16 Oct 2026 18:50:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wimoor-auth-bypass/WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows unauthorized tenants to escalate privileges and access sensitive financial data by forging the unsigned X-USERINFO header.WIMOOR through commit ec86736 is susceptible to an authentication bypass vulnerability. The flaw exists because the application incorrectly processes the unsigned 'X-USERINFO' HTTP header when backend service ports are accessed directly, bypassing the intended gateway or proxy authentication mechanisms. By manipulating the 'companyid', 'manager', or 'admin' fields within this header, an unauthenticated attacker can successfully impersonate any tenant, including administrative accounts. This flaw allows unauthorized actors to read and modify sensitive internal information, including order histories, financial records, and Amazon seller authorizations. This represents a significant risk to organizations using WIMOOR, particularly if backend instances are reachable from untrusted network segments.

Impact

Successful exploitation allows for full tenant impersonation and unauthorized access to sensitive business operations. Attackers can view or manipulate financial data, modify order processing, and compromise third-party integrations such as Amazon seller authorizations, potentially leading to significant financial loss and operational disruption for users of the platform.

Recommendation

  • Immediately restrict network access to WIMOOR backend service ports to ensure all traffic must traverse the authorized gateway, preventing direct access.
  • Patch WIMOOR by updating to a version beyond commit ec86736, ensuring that the application validates the authenticity of 'X-USERINFO' headers instead of relying on client-provided data.
  • Review web application firewall (WAF) logs for any incoming requests containing custom 'X-USERINFO' headers, which should be considered anomalous if originating from external or non-internal-gateway IP addresses.
]]>highadvisoryauthentication-bypassweb-applicationcloud