EUVD-2026-50056
GHSA-5fqm-cc34-fcf5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible, low complexity, unauthenticated, no user interaction.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.
AnalysisAI
Authentication bypass in Cosmos Server 0.22.18 allows unauthenticated attackers to leak Constellation device metadata via the public-devices endpoint. The handler accepts any non-empty Authorization header but does not validate the bearer token, exposing device names, IPs, and role flags. Publicly available exploit code exists, but no active exploitation is reported; the vulnerability is patched in version 0.22.19.
Technical ContextAI
Cosmos Server is a self-hosted server manager with a Constellation VPN feature that securely connects devices. The endpoint /cosmos/api/constellation/public-devices is registered on the authenticated admin API router and undergoes tokenMiddleware which only validates tokens with a specific cosmos_ prefix. The handler strips the Bearer prefix but never validates the token, allowing any non-empty bearer value to bypass authentication (CWE-287 Improper Authentication). The flaw exists in src/constellation/api_devices_public.go where the handler queries all non-blocked, non-invisible devices without filtering by the stripped token.
RemediationAI
Upgrade to Cosmos Server version 0.22.19, which includes the fix (commit 59c561d686c8f9843b3e092b50f6346c481d8bbf and release v0.22.19). As a workaround, disable the Constellation feature if not required by setting the appropriate configuration option, or restrict network access to the /api/constellation/public-devices endpoint via a reverse proxy or firewall. Note that disabling Constellation may break remote access functionality for existing devices.
More in Cosmos Server
View allSame weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today