BadHost - CVE-2026-48710 Starlette Host-Header Auth Bypass

- badhost.org

CVE-2026-48710 (BadHost): a critical Starlette vulnerability that lets attackers bypass authentication via Host header injection. Affects FastAPI, Starlette, vLLM, LiteLLM, MCP servers, and any Python ASGI app with path-based auth middleware.

CuteStat Rank Not Applicable $ 8.94