OpenC3 COSMOS CVE-2026-42084

Attacker must possess a valid authenticated session token obtained through prior compromise (session hijacking, XSS, credential theft, network interception, or insider access). The vulnerability affects the password change functionality specifically, requiring access to the /auth endpoint with PR:L (low-privileged authenticated user). No special COSMOS configuration or features need to be enabled - default authentication model is vulnerable. Network access (AV:N) to the COSMOS web interface is required, but the primary limiting factor is the prerequisite breach condition. The vulnerability does NOT provide initial access; it is a privilege persistence mechanism post-compromise. Organizations using external authentication providers (LDAP, SAML, OAuth) instead of COSMOS internal authentication may have different exposure depending on password change workflow delegation.

The CVSS score of 8.1 (High) reflects network-accessible attack requiring low-privilege authenticated access (AV:N/AC:L/PR:L/UI:N) with high confidentiality and integrity impact but no availability impact. However, real-world exploitation requires a critical precondition: the attacker must ALREADY possess a valid session token through prior compromise (credential theft, XSS, session hijacking, or insider threat). This significantly constrains the attack population compared to remotely exploitable vulnerabilities. The GHSA advisory explicitly frames this as an 'assumed breach scenario' for establishing persistence rather than initial access. Public exploit code exists (detailed PoC in GitHub advisory with Burp Suite request examples), lowering the skill barrier for post-compromise exploitation. No CISA KEV listing identified at time of analysis, suggesting limited widespread exploitation despite POC availability. The primary business risk is operational continuity for command-and-control systems in aerospace, defense, and industrial control environments where COSMOS is deployed - an attacker maintaining admin persistence could manipulate embedded system commands, falsify telemetry data, or conduct sabotage operations. The vulnerability is most critical in multi-user COSMOS deployments with privileged separation, less critical in single-admin environments where the admin account is already the sole attack surface. Organizations without existing token-theft vectors (strong endpoint security, MFA, short session TTLs, network segmentation) face materially lower risk than the raw CVSS suggests.

An attacker conducts initial compromise through phishing, malware, or exploiting a separate vulnerability to steal a valid COSMOS session token from a legitimate user's browser or network traffic. Using the hijacked token, the attacker accesses the COSMOS web interface without knowing the actual password. When the legitimate user detects suspicious activity and attempts to reset their password using their known password, the attacker intercepts or independently issues a password change request via HTTP proxy (Burp Suite), submitting their stolen session token in the old_password parameter instead of the actual password. The flawed authentication logic accepts the token, allowing the attacker to set a new password, locking out the legitimate user and establishing persistent access even after detection and remediation attempts.