# CVE-2026-74994: inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

Status: published. Published: 2026-09-01. Updated: 2026-11-11.

The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/6982e381137ede21a4e1faf5fa2dd82321691176
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/c5ccec8ed25c70ec6557fd81277e4b2f52285c19
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/6101cb74ff2870718c622ba7af0c100f7f2524e3

## Affected products and versions

- Erlang / OTP (otp): ≥ 17.0; < * (affected, otp); unaffected at 27.3.4.17; unaffected at 28.5.0.6; unaffected at 29.0.6. Source: CNA: EEF
- Erlang / OTP (inets): ≥ 5.10; < * (affected, otp); unaffected at 9.3.2.7; unaffected at 9.6.2.3; unaffected at 9.7.2. Source: CNA: EEF
- Erlang / OTP (erlang/otp): ≥ 84adefa331c4159d432d22840663c38f155cd4c1; < * (affected, git); unaffected at 6982e381137ede21a4e1faf5fa2dd82321691176; unaffected at c5ccec8ed25c70ec6557fd81277e4b2f52285c19; unaffected at 6101cb74ff2870718c622ba7af0c100f7f2524e3; ≥ 6982e381137ede21a4e1faf5fa2dd82321691176; < * (unaffected, git); ≥ c5ccec8ed25c70ec6557fd81277e4b2f52285c19; < * (unaffected, git); ≥ 6101cb74ff2870718c622ba7af0c100f7f2524e3; < * (unaffected, git). Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 6 (medium); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: EEF

- CISA KEV: No listing in collected sources

- EPSS: 0.63% as of 2026-11-10; percentile 50.69%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-863, CWE-1289

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/erlang/otp/security/advisories/GHSA-c3cq-q8x6-547g (CNA: EEF; vendor-advisory)

- https://cna.erlef.org/cves/CVE-2026-74994.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-74994 (CNA: EEF; related)

- https://www.erlang.org/doc/system/versions.html#order-of-versions (CNA: EEF; x_version-scheme)

- https://github.com/erlang/otp/commit/6982e381137ede21a4e1faf5fa2dd82321691176 (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/c5ccec8ed25c70ec6557fd81277e4b2f52285c19 (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/6101cb74ff2870718c622ba7af0c100f7f2524e3 (CNA: EEF; patch)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-74994; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-74994; retrieved 2026-11-11; source updated Not reported

Revision: 139a7ed77431d0495800a7d767c3f35526a0d781632c068f4c52b4eee650a0a5

Canonical: https://y2.dev/cve/CVE-2026-74994

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.