CVE-2026-66013CWE-639

CVE-2026-66013

published July 25, 2026

CVSS
9.3
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00679 · 51.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-25T15:17Z
References (3)
https://github.com/openremote/openremote/security/advisories/GHSA-gpfc-h59v-63cv · [email protected]https://www.vulncheck.com/advisories/openremote-before-authentication-bypass-via-console-registration · [email protected]https://github.com/openremote/openremote/security/advisories/GHSA-gpfc-h59v-63cv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 JUL 10:45Z
    OpenRemote before 1.26.2 Authentication Bypass via Console Registration
    cvelistv5