CVE-2026-41448: Adguardteam Adguardhome

Critical severity, CVSS 9.4. EPSS: 0.8% chance of exploitation in the next 30 days.

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in the Admin-Token header to redirect file reads to arbitrary paths.

Affected products

• Adguardteam Adguardhome: before 0.107.77 (fixed in 0.107.77)

Published 2026-06-08. Last modified 2026-07-23.