CVE-2026-103057CWE-306

CVE-2026-103057

Medium · published September 30, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00253 · 16.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-30T05:16Z
References (6)
https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/index.ts#L681-L691 · [email protected]https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43 · [email protected]https://github.com/beenuar/AiSOC/releases/tag/v12.0.0 · [email protected]https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37 · [email protected]https://www.vulncheck.com/advisories/aisoc-5.1.0-before-12.0.0-missing-authentication-on-realtime-service-internal-endpoints · [email protected]https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 30 SEP 00:19Z
    AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints
    cvelistv5