CVE-2026-66013

EUVD-2026-49044
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
9.3 CRITICAL
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openremoteopenremote
𝑥
< 1.26.2
CNA
Common Weakness Enumeration
References
https://github.com/openremote/openremote/security/advisories/GHSA-gpfc-h59v-63cv
https://www.vulncheck.com/advisories/openremote-before-authentication-bypass-via-console-registration