EUVD-2026-50056
GHSA-5fqm-cc34-fcf5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend GET request with arbitrary Bearer token
-
ExploitBypass token validation in tokenMiddleware
-
ImpactRetrieve unauthorized Constellation device metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Constellation feature must be enabled (disabled by default in Cosmos Server), and there must be at least one non-blocked, non-invisible device registered in the database. The attack requires only network access and any non-empty Authorization header; no authentication credentials are needed. Limiting factors include the default disabled state of Constellation and the requirement for existing device registrations. |
| Impact | CVSS 5.3 (medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates low confidentiality impact with no privilege or user interaction required. However, exploitation requires the Constellation feature to be enabled (disabled by default) and at least one device registered. No EPSS score or KEV listing is available, but a proof-of-concept is described in the vendor advisory, elevating risk for deployments with Constellation enabled. For default configurations, the exposure is limited, but misconfigured instances are easily exploitable. |
| Exploit ScenarioDerived | An attacker sends a GET request to /cosmos/api/constellation/public-devices with an arbitrary Authorization header (e.g., Bearer fake-token). The server bypasses validation and returns a JSON list of device names, IPs, and user nicknames. This can be performed remotely without authentication, exposing internal network topology. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Authentication bypass in Cosmos Server 0.22.18 allows unauthenticated attackers to leak Constellation device metadata via the public-devices endpoint. The handler accepts any non-empty Authorization header but does not validate the bearer token, exposing device names, IPs, and role flags. Publicly available exploit code exists, but no active exploitation is reported; the vulnerability is patched in version 0.22.19.
RemediationAI
Upgrade to Cosmos Server version 0.22.19, which includes the fix (commit 59c561d686c8f9843b3e092b50f6346c481d8bbf and release v0.22.19). As a workaround, disable the Constellation feature if not required by setting the appropriate configuration option, or restrict network access to the /api/constellation/public-devices endpoint via a reverse proxy or firewall. Note that disabling Constellation may break remote access functionality for existing devices.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cosmos Server is a self-hosted server manager with a Constellation VPN feature that securely connects devices. The endpoint /cosmos/api/constellation/public-devices is registered on the authenticated admin API router and undergoes tokenMiddleware which only validates tokens with a specific cosmos_ prefix. The handler strips the Bearer prefix but never validates the token, allowing any non-empty bearer value to bypass authentication (CWE-287 Improper Authentication). The flaw exists in src/constellation/api_devices_public.go where the handler queries all non-blocked, non-invisible devices without filtering by the stripped token.
Know when Cosmos Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible, low complexity, unauthenticated, no user interaction.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Cosmos Server
View allSame weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Exploit-DB