FileBrowser versions before 2.63.19 are vulnerable to an authentication bypass that could allow unauthenticated attackers to gain unauthorized access to the system.

The vulnerability stems from the improper handling of case sensitivity (CWE-178), which allows an attacker to bypass authentication mechanisms. This flaw can be triggered by an unauthenticated remote attacker to gain access to the application.

Authentication bypass vulnerabilities are critical because they grant unauthorized access to system resources without requiring valid credentials. An attacker could exploit this to view, modify, or delete sensitive files managed by the application. The CVSS 4.0 score of 8.1 indicates a high risk to the overall security posture of the affected infrastructure.

Immediate Action: Update to FileBrowser version 2.63.19 or later.

Proactive Monitoring: Review access logs for unusual login patterns or attempts to access files using varying character casing.

Compensating Controls: Restrict network access to the FileBrowser instance using IP allowlisting or VPNs until the application can be updated.

Public Exploit Available: Unknown.

Authentication bypass is a severe security failure that warrants immediate attention. All users of FileBrowser must upgrade to version 2.63.19 to remediate this vulnerability and ensure that access controls are correctly enforced.