DroneAware CVE-2026-48117
MEDIUMSeverity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
AC:H reflects the timing prerequisite of registering before the victim; UI:R captures required victim activation; C:H/I:H reflect full account takeover; A:N as availability is unaffected.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an attacker could register an account using a victim's email address with an attacker-controlled password before the victim completed account activation. When the legitimate owner later activated the account, either by clicking the email verification link or by logging in via Google SSO, the attacker-set password became fully valid, enabling silent and persistent account takeover without any notification to the victim. The vulnerability was fixed server-side on 2025-05-20; no user action is required. Node binaries and self-hosted detection nodes are not affected. There are no workarounds; the fix was deployed server-side and no client-side mitigation is applicable.
AnalysisAI
Account pre-hijacking in the centralized droneaware.io cloud platform allowed unauthenticated attackers to register an account using a victim's email address with an attacker-controlled password prior to the victim completing account activation. Once the legitimate owner activated their account - either via an email verification link or by authenticating through Google SSO - the attacker-set password remained fully valid, granting silent and persistent account takeover with no notification to the victim. The vulnerability was remediated server-side by the vendor on 2025-05-20; no public exploit or CISA KEV listing has been identified, and no user action is required.
Technical ContextAI
DroneAware is a drone detection platform consisting of a centralized cloud backend (droneaware.io), distributed detection nodes, and client binaries. The vulnerability maps to CWE-287 (Improper Authentication), specifically the pre-account-hijacking class of flaw in which the registration and activation workflows fail to enforce email ownership before binding credentials to a new account. The platform supports both native email/password registration and federated identity via Google SSO. The root cause is that the server accepted and retained an attacker-supplied password for an unverified email, and critically, did not invalidate or re-evaluate that password when the legitimate owner later activated the account through either authentication pathway. This means the SSO activation flow did not replace or revoke the pre-set attacker credential, allowing dual persistent access. Per the CPE string (cpe:2.3:a:fduflyer:droneaware-node-releases:*:*:*:*:*:*:*:*) and advisory, the vulnerable component is the fduflyer-maintained DroneAware platform; however, the advisory explicitly confirms that self-hosted detection nodes and Node binaries are not affected - only the centralized server.
RemediationAI
The vendor deployed a server-side fix to the centralized droneaware.io backend on 2025-05-20; no client-side action, patch installation, or configuration change is required by users. The fix is already in effect for all accounts on the hosted platform. The vendor advisory explicitly states there are no applicable workarounds, as the flaw resided entirely in the server registration and activation logic. Users who created accounts before 2025-05-20 and suspect they may have been targeted should rotate their passwords and review account access logs if that functionality is available. The full advisory is available at https://github.com/fduflyer/DroneAware-Node-Releases/security/advisories/GHSA-h243-pmjf-chcj.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today