A vulnerability in the Caddy server platform allows authenticated attackers to perform identity injection and privilege escalation by failing to sanitize headers.

The flaw exists within the forward_auth copy_headers functionality, where the server fails to properly validate or strip headers provided by the client. This allows an authenticated user to manipulate authentication headers, leading to potential identity impersonation and privilege escalation.

Successful exploitation of this vulnerability poses a high risk to organizational security, as it allows unauthorized users to escalate their privileges or impersonate other users within the environment. With a CVSS score of 8.1, the vulnerability is classified as High severity, reflecting the potential for significant compromise of system access controls. Failure to remediate this issue could lead to unauthorized data access or administrative control over applications protected by Caddy.

Immediate Action: Update Caddy to version 2.11.2 or later to apply the necessary header sanitization logic.

Proactive Monitoring: Review access logs for suspicious header patterns or anomalous authentication requests that deviate from standard user behavior.

Compensating Controls: If immediate patching is not feasible, implement strict input validation rules at the application layer or via an upstream proxy to strip unauthorized authentication headers before they reach the Caddy server.

Public Exploit Available: Unknown.

Given the potential for privilege escalation and the existence of proof-of-concept material, this vulnerability should be treated as a priority for all Caddy deployments. Administrators must verify their current version and transition to 2.11.2 immediately to prevent potential identity-based attacks against their services.