CVE-2026-121926
Deferred Deferred - Pending Action

Authentication Bypass in yezhihao jt808-server

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulDB

Description
A vulnerability was detected in yezhihao jt808-server up to a07f68c466b560b97ef41edb8a4966469abdf83e. Affected is the function WebMvcConfig.addInterceptors of the component Web Management API. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121926
EUVD
EUVD-2026-117001

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yezhihao jt808-server a07f68c466b560b97ef41edb8a4966469abdf83e

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121926 is a missing authentication vulnerability in the yezhihao jt808-server project, which implements the JT/T 808 telematics standard for vehicle tracking and monitoring. The flaw allows remote attackers to bypass authentication in the web management API due to missing authorization checks in the WebMvcConfig.addInterceptors function.

Detection Guidance

Scan for open port 8100 on your network using tools like nmap (nmap -p 8100 <target_IP>). Check if unauthenticated requests to /device/all, /device/raw, or other endpoints under /device/ return sensitive data or allow command execution. Review web server logs for suspicious activity targeting these paths.

Impact Analysis

An attacker with network access to port 8100 can exploit this to send arbitrary JT808 commands to vehicles, including vehicle control, terminal reset, firmware upgrades, camera snapshots, or text messages. They can also enumerate connected terminals to retrieve sensitive data like SIM numbers, license plates, and GPS coordinates.

Compliance Impact

This vulnerability, which allows unauthenticated access to vehicle tracking and monitoring systems, could severely impact compliance with GDPR and HIPAA. Unauthorized access to sensitive data like GPS coordinates, SIM numbers, and license plates may violate GDPR's data protection requirements for personal data processing. For HIPAA, if the system handles health-related vehicle telematics data, the lack of authentication could lead to unauthorized access to protected health information, breaching HIPAA's security and privacy rules.

Mitigation Strategies

Immediately restrict access to port 8100 by binding it to localhost or a trusted network. Implement authentication and authorization for all /device/ endpoints. Disable CORS for external origins and remove Swagger in production. Update firewall rules to block unauthorized access to the management API.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121926. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...