External risk intelligence

WIMOOR Authentication Bypass via Forged X-USERINFO Header

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-111691

The vulnerability requires the attacker to bypass the gateway and reach backend service ports directly to exploit the authentication bypass via the X-USERINFO header. While network-reachable in some environments, backend services are typically protected by internal network controls and are not intended to be exposed to the public internet.

Authentication Bypass

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

WIMOOR software contains a flaw that could allow unauthorized access to sensitive company data. This vulnerability, specifically an authentication bypass, enables attackers to impersonate users and access or alter information such as orders, financial details, and authorization settings across different company accounts. The primary concern is to determine if our environment is exposed to this risk.

Allows unauthorized access to sensitive company data.
Matters because it bypasses security controls.
Confirm if WIMOOR is used and if it's exposed.

Attack Path

How an attacker could exploit the issue

An attacker could impersonate any user within WIMOOR by directly accessing backend service ports and bypassing the standard gateway. This allows them to send an unsigned `X-USERINFO` header with forged tenant and user type values, enabling them to read and alter sensitive data belonging to other tenants.

Attacker reaches backend service ports directly.
Sends unsigned `X-USERINFO` header.
Risk of unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

Attackers who can directly access backend service ports, bypassing the gateway, could impersonate any tenant and privilege level within WIMOOR. This is achieved by sending an unsigned X-USERINFO header with forged company ID and user type values. When supported by the advisory, this could allow unauthorized access to sensitive company data.

Other tenants' orders and financial data.
Direct backend access bypassing gateway.
Unauthorized reading and modification of data.

Operational Fix

Recommended remediation, mitigation, and detection steps

WIMOOR's authentication bypass requires direct access to backend services, bypassing any gateway, making infrastructure and platform teams the likely first responders to identify affected systems. The initial practical move is to confirm the presence of WIMOOR, determine its reachability and criticality, and then identify the accountable owner to plan remediation based on risk.

Identify WIMOOR deployment and owners.
Verify backend service reachability and criticality.
Plan targeted remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WIMOOR software used for?

WIMOOR is an ERP platform primarily used by Amazon sellers to manage business operations. It centralizes critical functions including order processing, financial tracking, and the management of seller account authorizations, acting as a core hub for handling sensitive e-commerce data.

What does CWE-290 mean for CVE-2026-111691?

CVE-2026-111691 involves an authentication bypass categorized as CWE-290, which is an authentication bypass by spoofing. In this case, the software incorrectly trusts an unsigned header named X-USERINFO. By forging this header with specific identity values, an attacker can trick the system into granting them the privileges of any user, including administrative access, without providing legitimate credentials.

How does an attacker trigger this authentication bypass?

To exploit this, an attacker must bypass the primary gateway and reach the backend service ports directly. Sending the forged X-USERINFO header through the standard, secure gateway will not work, as the gateway is designed to filter or process such headers correctly. The vulnerability exists specifically because the backend services themselves fail to verify the authenticity of the information provided in the header.

Is my WIMOOR instance at risk?

According to Halo Surface Signal, the risk is considered 'Unlikely' for most environments because the exploit requires direct network access to backend service ports. If your backend services are protected by internal network controls and are not exposed to the public internet, they are not reachable by external attackers, significantly reducing the likelihood of successful exploitation.

What should I do first to address this vulnerability?

Your first step is to confirm where WIMOOR is deployed within your infrastructure and identify the accountable team. Verify if any backend service ports are inadvertently exposed to the network. Work with your infrastructure team to ensure that these internal services are properly shielded behind the application gateway, preventing any unauthorized direct access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.