What is the CVSS score of CVE-2026-21854?

CVE-2026-21854 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Tarkov Data Manager are affected by CVE-2026-21854?

Organizations using Tarkov Data Manager face critical risk from CVE-2026-21854, a improper authentication vulnerability rated CVSS 9.8.. A patch is available.

How to fix or mitigate CVE-2026-21854?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Audit authentication configurations and rotate any potentially compromised credentials.

Tarkov Data Manager CVE-2026-21854

CRITICAL

Improper Authentication (CWE-287)

2026-01-07 security-advisories@github.com

Authentication Bypass Tarkov Data Manager Tarkov

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 03, 2026 - 16:21 nvd

Patch available

CVE Published

Jan 07, 2026 - 19:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property access vulnerability, combined with loose equality type coercion. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.

AnalysisAI

Tarkov Data Manager's login endpoint can be bypassed using JavaScript prototype property access combined with loose equality type coercion. Any unauthenticated user can gain full admin access. Fixed in January 2025 commits.

Technical ContextAI

The login function uses loose equality (==) for password comparison and is vulnerable to JavaScript prototype chain access (CWE-287). An attacker can exploit the prototype property (e.g., sending {'password': {'__proto__': ...}}) combined with type coercion to make the comparison evaluate as truthy regardless of the actual password.