EUVD-2026-42551
GHSA-3mfh-f79j-gpv8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible via authenticated low-privilege account; sensitive data exposure in transit yields high confidentiality impact with no integrity or availability effects.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentication Bypass.
This issue affects OSOS: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Sensitive authentication data is inserted into network-transmitted responses in OSOS, the energy management platform by Sayax Energy Technologies Inc., enabling authenticated low-privilege users to extract credentials or session tokens and bypass authentication controls. All versions through build 09072026 are affected with no vendor patch available - TR-CERT disclosed this vulnerability but received no response from the vendor. No public exploit code has been identified at time of analysis, though the network-accessible attack vector with low complexity raises practical risk in industrial energy environments where even low-privilege account access is common.
Technical ContextAI
CWE-201 (Insertion of Sensitive Information Into Sent Data) describes a flaw in which an application inadvertently embeds sensitive data - such as session tokens, password hashes, or authentication parameters - inside data it transmits over the network, where it can be intercepted or read by the authenticated recipient. In OSOS (CPE: cpe:2.3:a:sayax_energy_technologies_inc.:osos:*:*:*:*:*:*:*:*), this manifests as authentication-relevant secrets being present in observable API responses or inter-component traffic, allowing a low-privilege user to recover those secrets and assume identities or roles beyond their authorization level. The energy sector context is significant: OSOS is an operational software platform, and privilege escalation within such systems can affect configuration, monitoring, or control functions with physical-world consequences.
RemediationAI
No vendor-released patch has been identified at time of analysis. Organizations running any version of OSOS through 09072026 should immediately restrict network access to the OSOS application to trusted internal hosts and VPN-authenticated personnel, reducing the practical reach of the AV:N exploitation vector. Revoke or minimize low-privilege accounts where operationally feasible, as PR:L is the primary gating condition - fewer valid low-priv accounts reduces the exploitable population. Implement network traffic inspection or DLP controls to detect anomalous credential-like data in outbound or intra-system OSOS communications. If the application exposes APIs, consider placing a reverse proxy that strips or inspects response payloads for sensitive token patterns. Monitor the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0520 for any vendor response or patch release. In the absence of vendor engagement, consider replacing or isolating OSOS from sensitive network segments until a fix is available.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today