online scanner
Scans your apps to detect a critical Starlette vulnerability that allows attackers to bypass authentication
Last verified:
What is online scanner?
BadHost (CVE-2026-48710) is a free online scanner for detecting a critical Starlette vulnerability that allows attackers to bypass authentication via Host header injection. The tool was developed by Nemesis in collaboration with X41 D-Sec, the security firm that discovered the vulnerability during an OSTIF-sponsored audit. Starlette versions below 1.0.1 derive request.url from the Host header without sanitization, enabling attackers to forge request.url.path and bypass path-based auth middleware.
The scanner supports multiple scan modes including FastAPI/Starlette applications, AI Infrastructure, MCP Server, and Custom targets. The FastAPI/Starlette mode auto-discovers protected endpoints via /openapi.json schema parsing and common path patterns covering admin panels, REST APIs, AI agent platforms, e-commerce, and SaaS applications. Advanced settings include X-Forwarded-Host mode for bypassing proxies like CloudFlare and Nginx that reject non-standard Host values, with Auto, Always, and Off options.
This tool is designed for security professionals, developers maintaining FastAPI/Starlette applications, AI infrastructure teams managing LLM inference servers (vLLM, LiteLLM), MCP server operators, and organizations using AI agent frameworks (Langflow, Dify, CrewAI, Open WebUI, BentoML, Gradio). The scanner uses raw TCP sockets because standard HTTP clients normalize the Host header, and employs a two-tier testing approach: Tier 1 tests for denylist (fail-open) patterns while Tier 2 discovers unauthenticated paths for allowlist-based (fail-closed) middleware.
The vulnerability affects thousands of applications including vLLM, LiteLLM, MCP servers, Google ADK-Python, Ray Serve, and BentoML. MCP servers are especially at risk because the MCP spec mandates unauthenticated OAuth discovery endpoints, providing a reliable exploitation path. The scanner has added presets for Roboflow Inference with auto-detection for /infer/* and /workflows/* endpoints.
online scanner pricing
Pricing model: Freemium
Completely free online scanner. No sign-up required, no API key needed, no rate limits. Scan as many servers as needed at no cost.
online scanner pros
- Free online scanner with no sign-up required
- No API key needed
- No rate limits on scans
- Detects critical CVE-2026-48710 BadHost vulnerability
- Auto-discovers protected endpoints via /openapi.json parsing
- Supports FastAPI/Starlette, AI Infrastructure, MCP Server, and Custom modes
- X-Forwarded-Host bypass mode works through CloudFlare and Nginx proxies
- Auto retry mode handles proxy rejection of malformed Host headers
- Two-tier testing catches both denylist and allowlist middleware patterns
- Uses raw TCP sockets to avoid Host header normalization
- Covers major AI platforms: vLLM, LiteLLM, Langflow, Dify, CrewAI, Open WebUI
- Roboflow Inference preset with auto-detection for /infer/* and /workflows/*
- Configurable bypass strategies: prefix, query-absorb, root-absorb
- Results in seconds after pasting server URL
- Collaboration between X41 D-Sec and Nemesis for credibility
online scanner cons
- Only scans for CVE-2026-48710, not other vulnerabilities
- Requires internet access (online scanner only)
- No local installation option through this web interface
- POST-only endpoints probed with GET which may miss some issues
- SSE transport support discontinued in latest MCP (experimental only)
- May not detect middleware using scope[path] instead of request.url.path
- Does not scan for vulnerabilities in non-Starlette/FastAPI frameworks
- Limited to path-based auth bypass detection only
Frequently asked questions about online scanner
What is BadHost / CVE-2026-48710?
BadHost is a critical severity vulnerability in Starlette versions below 1.0.1 where request.url is built by concatenating the HTTP Host header with the request path without sanitization. An attacker can send a crafted request with a Host header like 'example.com/health?x=' which causes request.url.path to return '/health' instead of the actual path '/protected'. Any middleware using request.url.path for authentication decisions can be bypassed this way.
Which projects are affected?
Any Python application built on Starlette or FastAPI using starlette < 1.0.1 that uses request.url or starlette.datastructures.URL in middleware to make security decisions based on path. This includes vLLM, LiteLLM, AI agent frameworks, MCP gateways, Google ADK-Python, Ray Serve, BentoML, Langflow, Dify, CrewAI, Open WebUI, Gradio, Paperless-ngx, and custom APIs using Starlette routing with auth middleware.
Does a reverse proxy protect me?
Yes. RFC-compliant reverse proxies like nginx, Caddy, Traefik, and HAProxy validate and reject invalid Host headers, which neutralizes the injection. However, many deployments especially dev, staging, and self-hosted instances expose ASGI servers directly without a proxy, leaving them vulnerable.
How does the scanner work?
The scanner first confirms a protected endpoint denies access without credentials. Tier 1 tests whether middleware uses a denylist (fail-open) pattern by injecting a random path into the Host header. If Tier 1 fails, Tier 2 discovers known unauthenticated paths and injects those for allowlist-based (fail-closed) middleware. Raw TCP sockets are used because standard HTTP clients normalize the Host header.
What is X-Forwarded-Host mode?
By default the malicious payload is sent in the Host header. Some proxies like CloudFlare and Nginx reject non-standard Host values with 400. X-Forwarded-Host mode sends the payload via X-Forwarded-Host instead with a valid Host. Auto mode retries with X-Forwarded-Host only when the server returns 400, and is now enabled by default.
Can I run this locally?
Yes. The X41 open-source repository includes a Python PoC exploit, Semgrep rules for static detection, and CodeQL queries for large-scale scanning. You can use Semgrep rules to check your codebase for request.url.path usage in middleware, or run CodeQL queries against any Python project to find vulnerable patterns.
Why didn't Mythos find this vulnerability?
CVE-2026-48710 is not a bug in one file or repo but spans three independent layers: ASGI servers pass raw Host headers, Starlette trusts it for URL construction, and middleware authors assume request.url.path is safe. Each component behaves correctly in isolation. The vulnerability emerges from interaction between layers across HTTP, ASGI, Starlette, and MCP specifications, requiring manual security research and end-to-end exploit labs.
How do I fix BadHost?
Update Starlette to version 1.0.1 or later which ignores Host headers containing invalid characters. Avoid path-based auth middleware and prefer Starlette's requires() decorator or FastAPI's Depends() and Security() which are enforced on actual endpoints. Deploy an RFC-compliant reverse proxy (nginx, Caddy, Traefik, HAProxy) that validates and normalizes Host headers. Use scope[path] instead of request.url.path if middleware is required.
Is FastAPI's built-in security safe?
Yes. FastAPI's built-in Depends() security uses route matching, not request.url.path, so standard dependency-injection auth is safe. The risk is specifically in custom BaseHTTPMiddleware or raw ASGI middleware that uses request.url.path for authentication decisions.
What scan modes are available?
The scanner offers FastAPI/Starlette mode for general applications with auto-discovery via /openapi.json, AI Infrastructure mode for LLM servers, MCP Server mode for Model Context Protocol gateways, and Custom mode. The FastAPI/Starlette mode covers admin panels, REST APIs, AI agent platforms, e-commerce, and SaaS with configurable bypass strategies.