CVE-2022-40494

Deeper analysis

NPS, an open-source intranet penetration proxy, contained an authentication bypass vulnerability in all versions prior to 0.26.10. The flaw (CWE-287) allows an attacker to circumvent authentication by repeatedly generating and transmitting valid Auth key and Timestamp parameter values, resulting in a CVSS 9.8 rating that reflects unauthenticated network access with full confidentiality, integrity, and availability impact.

An unauthenticated remote attacker can exploit the issue simply by interacting with the NPS service over the network and supplying crafted authentication parameters. Successful exploitation grants the attacker the same privileges as a legitimate authenticated user, enabling complete control over the proxy instance and any tunneled resources.

Public references, including technical write-ups and proof-of-concept material hosted on GitHub and Carrot2 blogs, describe the parameter manipulation technique and confirm that upgrading to NPS 0.26.10 or later eliminates the bypass. The EPSS score rose from a low baseline to a peak of 0.1490 in December 2025 before receding to its current value of 0.0816, indicating a measurable increase in observed exploitation interest well after initial disclosure.