Authentication bypass in OpenRemote console registration API (CVE-2026-66013)

The OpenRemote console registration API accepts a client-supplied asset identifier and, when that identifier matches an existing console asset, updates the asset's push notification token and metadata without requiring authentication, ownership validation, or realm verification. An unauthenticated remote attacker with knowledge of a valid console asset ID can overwrite stored push notification tokens and console metadata, enabling notification redirection, denial of delivery to legitimate consoles, and potential compromise of notification confidentiality and integrity in multi-tenant deployments. Affected versions: - <=1.26.1 We recommend updating to: 1.26.2. CVSS 9.3 · our assessment: act_now Reference: https://github.com/openremote/openremote/security/advisories/GHSA-gpfc-h59v-63cv Details: https://vuln.today/cve/CVE-2026-66013