Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel (CVE-2026-49446) | HOL Guard CVE