CVE-2026-49197CWE-287

Predator Connect W6x: Improper Authentication

Critical · published May 29, 2026

CVSS v4.0
10.0
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00525 · 43.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-05-29T08:24Z
EPSS history
Timeline
  • 29 MAY 08:24Z
    Predator Connect W6x: Improper Authentication
    cvelistv5