Skip to main content

Openremote CVE-2026-66013

| EUVDEUVD-2026-49044 CRITICAL
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-07-25 VulnCheck GHSA-jg8p-j9v5-g5x5
Authentication Bypass Openremote
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Jul 26, 2026 - 11:36 vuln.today
Patch available
Jul 25, 2026 - 12:03 EUVD
CVE Published
Jul 25, 2026 - 10:45 cve.org
CRITICAL 9.3

DescriptionCVE.org

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.

AnalysisAI

Unauthorized modification of push notification tokens in OpenRemote before 1.26.2 allows unauthenticated attackers to redirect or block push notifications to legitimate consoles. By supplying a known console asset identifier, an attacker can bypass authentication on the registration API to overwrite notification tokens and metadata, disrupting notification delivery. The issue is tracked as CVE-2026-66013; no public exploit is confirmed at time of analysis.

More in Openremote

View all
CVE-2022-31860 CRITICAL POC
9.8 Sep 06

An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule
CVE-2026-56784 HIGH
8.6 Jun 23

Cross-tenant alarm destruction in OpenRemote Manager before 1.24.2 lets any authenticated user in one realm permanently

CVE-2026-81679 HIGH
8.3 Aug 27

Cross-realm information disclosure in OpenRemote's Notification REST API exposes all tenants' notification history - inc
CVE-2026-62238 HIGH
7.2 Jul 17

SQL injection in OpenRemote's datapoint crosstab export endpoint (all versions before 1.26.0) lets an authenticated user
CVE-2026-73616 HIGH
7.1 Aug 13

Cross-realm authorization bypass in OpenRemote allows any authenticated realm administrator to permanently delete notifi
CVE-2026-65009 MEDIUM
5.3 Jul 21

Cross-tenant information disclosure in OpenRemote versions before 1.26.2 allows any authenticated user holding the read:
CVE-2026-67310 MEDIUM
5.3 Aug 01

Cross-tenant insecure direct object reference in OpenRemote versions up to and including 1.26.2 allows an authenticated

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-66013 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy