Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Roxy-WI allows login bypass via LDAP injection

CVE-2026-33432 · published 6 months ago
Summary

Roxy-WI versions up to 8.2.8.2 let anyone craft a special username that tricks the LDAP lookup into accepting them as a valid user. This means an attacker can get into the web interface without a password. Apply a fix or disable LDAP authentication until an update is released.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
roxy-wi roxy-wi <= 8.2.8.2
cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*
Original advisory text
Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely — gaining access to the application without knowing any valid password. As of time of publication, no known patches are available.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published20 Apr 2026
Updated4 Nov 2026
First seen20 Apr 2026
Sources
CVE-2026-33432 · NVD
CVE-2026-33432 · OSV
GHSA-hv3x-4w38-r92m · GHSA
Track software like this
Free during beta