critical9.3
CVE-2026-66013
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existi…
Impact
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.
Affected products
| Product | Affected versions |
|---|---|
| OpenRemote | before 1.26.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.