OpenAEV CVE-2026-71854

Exploitable against a default OpenAEV installation prior to 2.260622.0, where the /api/player/** lessons endpoints accept unauthenticated requests and trust a client-supplied userId without verifying caller identity or exercise membership. The sole concrete prerequisite is knowledge of a valid exercise UUID; no account, credentials, or user interaction are required. The primary limiting factor is that the attacker must obtain or guess that UUID - exploitation is not fully blind - and environments that have upgraded to 2.260622.0 or placed the API behind authentication/network controls are not affected.

This is a genuine, high-priority exposure for any organization running a default OpenAEV installation prior to 2.260622.0. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, which aligns cleanly with the CWE-306 (Missing Authentication) root cause and the description's statement that /api/player/** is callable without authentication on default installs. Confidentiality is rated High (C:H) because an attacker can read lessons-learned Q&A including author identities, and integrity Low (I:L) because answers can be created or overwritten under spoofed user IDs; no availability impact (A:N). The main real-world friction is not technical complexity but the need to know a valid exercise UUID - a knowledge prerequisite the CVSS vector does not capture, which tempers the otherwise trivial exploitability. Key corroborating signals are missing or unavailable: no EPSS score, no CISA KEV listing, and no public POC referenced, so there is no evidence of active exploitation - the 8.2 severity reflects potential impact on default configs rather than observed in-the-wild activity. The attack vector and complexity are internally consistent with the description, so no AV/AC conflict exists to flag.

An attacker who learns or guesses a valid exercise UUID sends unauthenticated HTTP requests to the /api/player/** lessons endpoints, passing an arbitrary userId query parameter. They harvest all lessons-learned questions, answers, and the real identities of the authors, then submit forged answers attributed to legitimate exercise participants. No public exploit code is identified at time of analysis, but the attack requires only a standard HTTP client.