CVE-2026-40910 is an authentication bypass in frp, the fast reverse proxy, scored CVSS 6.5. When routeByHTTPUser is used with httpUser and httpPassword, routing and authentication read different headers. frp 0.68.1 fixes it. Upgrade if you use that feature. Other frp setups are not affected.
What's affected
- Affected: frp 0.43.0 through 0.68.0
- Fixed: 0.68.1
- Scope: deployments that use routeByHTTPUser. The advisory says ordinary HTTP proxies without this feature are not affected.
In proxy style requests, the route is picked from the username in the Proxy-Authorization header, while the access check uses the regular Authorization header. The advisory says an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected route value may reach a protected backend.
How to check if you're exposed
Check the server version:
frps --version
Then check your server and client configuration for the feature:
grep -rn "routeByHTTPUser" /etc/frp ~/.config 2>/dev/null
If it does not appear, the condition from the advisory is not met on that system.
What to do now
- Upgrade frps and frpc to 0.68.1 or later.
- Search every frp configuration for routeByHTTPUser.
- Treat the route user value as guessable, and do not use it as a secret.
- Restrict network access to the HTTP vhost entrypoint where you can.
Why it matters
The weakness is CWE-287, improper authentication. Two parts of one request path used different sources for the same identity: one picked the destination and the other checked the password. When they diverge, a request can be sent to one place and checked against another.
The advisory proposes the fix: derive proxy mode credentials from the same header used for routing. This is an example of a rule worth remembering when you design access control, which is to authenticate the same identity that you route on. The record does not flag exploitation in the wild.
Quick check
Does this affect all frp HTTP proxies?
No. The advisory says it is specific to deployments that use routeByHTTPUser with httpUser and httpPassword.
Sources
Last reviewed: 19 October 2026.
