Nestjs Auth Service
Monthly
Account takeover in the EnergizeLab Eilik NestJS authentication service allows any registered user to hijack another account by manipulating a user ID field in account update requests, a mass assignment flaw (CWE-639). All versions of the service are affected (CPE: cpe:2.3:a:energizelab:nestjs_auth_service:*:*:*:*:*:*:*:*), and exploitation requires only a valid low-privilege account (PR:L) over the network with no user interaction. No public exploit has been identified at time of analysis, though the flaw is trivially automatable and carries a CVSS base score of 8.8.
The EnergizeLab Eilik NestJS authentication service grants device tokens for arbitrary robot serial numbers without requiring any credential, so an unauthenticated remote attacker can mint a valid token for any Eilik robot and impersonate that device against the vendor's cloud services. Rated 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), the flaw is trivially reachable over the network with no authentication or user interaction, and the dominant impact is to integrity of device identity rather than to confidentiality or availability. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS percentile was supplied with this record, so the practical risk is a genuinely easy-to-exploit flaw with bounded, identity-spoofing impact and no confirmation of real-world use; assessment signals point the same way.
Account takeover in the EnergizeLab Eilik NestJS authentication service allows any registered user to hijack another account by manipulating a user ID field in account update requests, a mass assignment flaw (CWE-639). All versions of the service are affected (CPE: cpe:2.3:a:energizelab:nestjs_auth_service:*:*:*:*:*:*:*:*), and exploitation requires only a valid low-privilege account (PR:L) over the network with no user interaction. No public exploit has been identified at time of analysis, though the flaw is trivially automatable and carries a CVSS base score of 8.8.
The EnergizeLab Eilik NestJS authentication service grants device tokens for arbitrary robot serial numbers without requiring any credential, so an unauthenticated remote attacker can mint a valid token for any Eilik robot and impersonate that device against the vendor's cloud services. Rated 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), the flaw is trivially reachable over the network with no authentication or user interaction, and the dominant impact is to integrity of device identity rather than to confidentiality or availability. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS percentile was supplied with this record, so the practical risk is a genuinely easy-to-exploit flaw with bounded, identity-spoofing impact and no confirmation of real-world use; assessment signals point the same way.