Auth bypass in Acer Predator Connect W6x

CVE-2026-49197

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

Vulnerability class: Broken Authentication

EPSS: 0.001 (17.1th percentile) — read the EPSS interpretation.