CVE-2026-89309

Deferred Deferred - Pending Action

Remote Code Execution in tbc

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: ENISA

Description

The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-89309

EUVD

EUVD-2026-98359

Affected Vendors & Products

Vendor	Product	Version / Range
tbc	tbc	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects the software tbc before version 1. The exact nature of the vulnerability is not specified in the provided context.

Detection Guidance

To detect this vulnerability, inspect HTTP requests to the WMS MobileServer API. Check if GET/HEAD requests or any requests with malformed Authorization headers bypass authentication. Use tools like Wireshark or tcpdump to capture and analyze traffic for missing or improperly formatted Authorization headers.

Impact Analysis

The impact is not detailed in the provided context. Users of tbc before version 1 may be exposed to potential security risks, but specifics are unavailable.

Compliance Impact

The provided CVE data does not specify how the vulnerability in tbc affects compliance with standards like GDPR or HIPAA.

Mitigation Strategies

Immediately update the WMS MobileServer to the latest patched version (2.0.7, 2.1.3, or 2.2.1). If updating is not possible, restrict network access to the service or disable it if unused. Ensure all HTTP methods require a valid bearer token in the Authorization header.

Hi! I’m here to help you understand CVE-2026-89309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70