CVE-2026-48710 (BadHost): Critical Starlette Host-Header Auth Bypass Vulnerability Affects FastAPI and Python ASGI Applications
A critical security vulnerability (CVE-2026-48710, dubbed "BadHost") has been discovered in Starlette web framework versions prior to 1.0.1, affecting FastAPI applications as well. The vulnerability allows authentication bypass via Host header injection, impacting Python ASGI applications including MCP servers, LLM proxies, and AI agent frameworks. Applicati
badhost.org6d ago
