CVE-2026-103057

EUVD-2026-89541
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.23%
Common Weakness Enumeration
References
https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/index.ts#L681-L691
https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43
https://github.com/beenuar/AiSOC/releases/tag/v12.0.0
https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37
https://www.vulncheck.com/advisories/aisoc-5.1.0-before-12.0.0-missing-authentication-on-realtime-service-internal-endpoints
https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37