CVE-2021-3116
7.5 HIGHbefore_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data...
Published: 2021-01-11 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 7.5 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CWE
- CWE-697
Affected products
| Vendor | Product |
|---|---|
| proxy.py_project | proxy.py |
Description
before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3116
- [Exploit reference]https://cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication/
- [Patch]https://github.com/abhinavsingh/proxy.py/pull/482/commits/9b00093288237f5073c403f2c4f62acfdfa8ed46
- [Other]https://pypi.org/project/proxy.py/2.3.1/#history
- [Exploit reference]https://cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication/
- [Patch]https://github.com/abhinavsingh/proxy.py/pull/482/commits/9b00093288237f5073c403f2c4f62acfdfa8ed46
- [Other]https://pypi.org/project/proxy.py/2.3.1/#history
Related CVEs
Same CWE
- CVE-2026-44249 — Netty is a network application framework for development of protocol servers and clients (8.1 HIGH)
- CVE-2026-45569 — Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers (8.1 HIGH)
- CVE-2026-45567 — Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers (8.3 HIGH)
- CVE-2026-47202 — Kavita is a cross platform reading server
- CVE-2026-9369 — A security flaw has been discovered in NousResearch hermes-agent 2026.4.23 (5.3 MEDIUM)