_{Four requests are stopped at the trust boundary. One passes through a gap in the check and reaches the system. That gap is CVE-2026-52021.}

_{Kumar Mohit  ·  also known as Mohit Narayan  ·  India}

Most of my work sits where untrusted code meets the system running it: secure code review, hardening containers that execute other people's code, and wiring scanners into CI so problems fail the build instead of reaching production.

Security Engineer at Appfend. Founder of Samyora, where I run engineering alongside company operations: incorporation, compliance, invoicing, and hiring.

_{CWE-306, Missing Authentication for a Critical Function  ·  code100x/cms  ·  assigned by MITRE, published August 2026}

The Next.js middleware guarding the mobile API tested only that an Auth-Key header was present, never that it was correct:

if (req.headers.get('Auth-Key')) {
  return NextResponse.next();   // presence is not validity
}

Any arbitrary value passed the check. Handlers behind that guard then trusted a client-supplied header to decide who the caller was, so a fail-open gate plus downstream trust in client input chained into impersonation and unauthenticated reads of protected data.

flowchart LR
    A["Attacker<br/>Auth-Key: anything"] --> B{"withMobileAuth<br/>middleware"}
    B -->|"header is present<br/>so the check passes"| C["Route handler"]
    B -.->|"value is never compared<br/>against a secret"| F["CWE-306<br/>fail-open"]
    C -->|"trusts client-supplied<br/>identity header"| D[("Protected<br/>course data")]
    C --> E["Impersonate<br/>any user"]

Read the full CVE-2026-52021 disclosure writeup

_{Built at Appfend, a multi-tenant platform that runs untrusted tenant code. Descriptions are capability-level; the code is the company's.}

Behavioral vulnerability validator  _{Go chromedp} A binary that proves a vulnerability is genuinely exploitable rather than merely present. It drives real browser flows headlessly and runs differential analysis against vulnerable and patched builds of the same target, so a finding only passes when the exploit works against one and fails against the other.

Fail-closed LLM reverse proxy  _Go A gateway in front of model backends that denies by default. Unknown routes and methods are rejected rather than forwarded, and upstream failure surfaces as a clean error instead of leaking the backend. The property worth having: a misconfiguration produces a closed door, not an open one.

Container hardening for untrusted workloads  _{Docker ECR} Removed sudo, stripped SUID/SGID bits, restricted the validator binary to root-only, and moved boot secrets behind encryption so they are not readable from a compromised tenant context. Published the hardened base image to ECR.

LLM-as-judge code review grading  _{Python Gitea} Automated grading of submitted pull requests against per-exercise rubrics, with a fail-safe default so a misconfigured grader falls back to the restrictive path instead of passing everything.

DevSecOps detect-and-gate curriculum Hands-on material covering SAST, SCA, SBOM, IaC scanning, secrets detection, and artifact signing, with a four-tier verification methodology so every exercise is proven to work before it ships.

Going deep on AWS security with hands-on Terraform rather than console clicking, and doing regular vulnerability research in container runtimes: runc, Kata Containers, containerd. Staying on one codebase long enough to understand it beats spraying reports across many. The CVE above came from that change of approach.

LinkedIn  ·  TryHackMe  ·  Credly  ·  X  ·  mohit724196@gmail.com