CVE-2026-89309

The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for GET and HEAD requests; requests
using any other HTTP method are processed without an authentication check.
Second, for any HTTP method including GET and HEAD, a request carrying a
malformed or non-bearer Authorization header is passed through without
a valid token being required.





The middleware does validate a token whenever a
well-formed one is present, but in these two cases it does not
require one. A remote attacker with network access to the service can
therefore invoke API functionality without valid credentials.