Cosmos Server
Monthly
Authentication bypass in Cosmos Server 0.22.18 allows unauthenticated attackers to leak Constellation device metadata via the public-devices endpoint. The handler accepts any non-empty Authorization header but does not validate the bearer token, exposing device names, IPs, and role flags. Publicly available exploit code exists, but no active exploitation is reported; the vulnerability is patched in version 0.22.19.
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Authentication bypass in Cosmos Server 0.22.18 allows unauthenticated attackers to leak Constellation device metadata via the public-devices endpoint. The handler accepts any non-empty Authorization header but does not validate the bearer token, exposing device names, IPs, and role flags. Publicly available exploit code exists, but no active exploitation is reported; the vulnerability is patched in version 0.22.19.
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.