CVE-2026-120191
Received Received - Intake

Missing Authentication in Presenton

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.12-beta can resolve this issue. Patch name: 44c8a61122b21f17642d717b0c4d6f2c54c0f180. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120191
EUVD
EUVD-2026-114750

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a Presenton 0.9.11-beta

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120191 is a vulnerability in Presenton up to version 0.9.11-beta where authentication for local APIs is disabled by default. The application binds predictable ports for its backend and frontend, allowing remote attackers with local session access to interact with APIs without authentication. This enables actions like accessing sensitive data, modifying settings, or hijacking LLM traffic.

Detection Guidance

Check if Presenton v0.9.11-beta is running by scanning for open ports starting from 40000 using tools like netstat or nmap. Look for FastAPI endpoints like /api/v1/auth/status or /app_data/ exposed without authentication. Verify if environment variables for authentication are unset or set to unrecognized values.

Impact Analysis

An attacker with access to your user session could exploit this to read presentations, configurations, or API keys, modify settings, consume paid services like image generation, or redirect AI model traffic. The predictable ports make it easier for attackers to discover and interact with exposed services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Unauthorized modifications to configurations or exposure of API keys may also breach compliance requirements for data integrity and access controls.

Mitigation Strategies

Upgrade Presenton to v0.9.12-beta or later immediately. Ensure the environment variable for authentication is explicitly set to disable the vulnerability. Restrict network access to local ports and disable external API access in the Electron app settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120191. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart