Presenton CVE-2026-120191

Per the patch, the condition is running the Electron desktop build of Presenton, whose local Next.js and FastAPI HTTP servers (bound to loopback) previously operated without authentication - Electron ran without account login (DISABLE_AUTH=true) and supplied no private per-launch credential, so anonymous local clients could reach the internal REST/export/file-read services. Exploitation is LIMITED by the loopback nature of these services: a genuinely remote attacker must either have local access to the host or lure the victim to a malicious web origin that performs cross-port/DNS-rebinding requests, since the endpoints bind to localhost rather than an external interface. The fix mints a random per-launch session token delivered as an httpOnly, sameSite=strict cookie plus an x-presenton-desktop-token header scoped to the two exact app origins, and additionally restricts readable local files to .txt documents within specific asset/temp subdirectories (excluding configuration, databases and logs). The vendor states upgrading to 0.9.12-beta is the resolution.

This is a medium-severity, modest-impact issue rather than a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) scores 5.5 and describes unauthenticated, low-complexity remote access, but all three impact metrics are Low (VC:L/VI:L/VA:L), so the consequence is limited information disclosure and limited tampering rather than full compromise. Exploit maturity is E:P (Proof-of-Concept): VulDB claims a public exploit exists, but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation - the signals point to opportunistic/targeted potential, not a mass-exploitation event. The vuln.today priority label is 'this_month', consistent with a real but non-urgent fix. One signal conflicts with the mechanism: the vector asserts AV:N (network) and PR:N (no privileges), yet the patch (commit 44c8a61) hardens the Electron desktop app's loopback Next.js/FastAPI HTTP servers, which previously ran with DISABLE_AUTH=true and no credential - a localhost service is only 'remote' via a malicious origin or DNS-rebinding, so the AV:N/AC:L rating likely overstates reachability. Verify the exact affected deployment mode (desktop vs. server) with the vendor before treating this as internet-exposed.

In the vulnerable Electron desktop build, Presenton's local HTTP API endpoints accepted requests without any session credential, so an anonymous local client - or a web page the victim visits that issues cross-origin/rebinding requests to the loopback port - could invoke internal file-read and export endpoints and read document text or other application files. VulDB reports a public exploit (CVSS E:P, Proof-of-Concept), though it is not independently verified as working exploit code. The low attack complexity means that if an attacker can reach the local service, no special timing or grooming is required.