TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming whic…

CVE-2026-80349 affects TarsWeb versions through 3.0.14, allowing complete authentication bypass via a forged X-Forwarded-For header and a uid query parameter. The vulnerability stems from Koa's proxy setting being enabled without restricting trusted upstream proxies, causing the framework to blindly trust client-supplied X-Forwarded-For headers. The middleware ssoMidware.js conflates IP allowlist matching with identity assignment, letting an attacker name any existing account including administrators. No credentials, cookies, or tickets are required to exploit the flaw. Successful exploitation grants access to all console routes including user/role administration, service configuration, and package upload and deployment. The fix in version 3.0.16 separates the allowlist branch from the identity assignment logic, assigning only a configured default account for trusted IPs rather than a caller-supplied one. This is a critical unauthenticated remote privilege escalation vulnerability in a widely used microservice management console.