CVE-2026-21854
Authentication Bypass in Tarkov Data Manager Enables Admin Access
Publication date: 2026-01-07
Last updated on: 2026-02-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| the-hideout | tarkov-data-manager | to 2.0.0 (exc) |
| tarkov | tarkov_data_manager | to 2025-01-02 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
| CWE-843 | The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authentication bypass in the Tarkov Data Manager's login endpoint. It occurs because the code improperly handles JavaScript prototype property access combined with loose equality (==) type coercion. Specifically, when the username is set to "__proto__", the lookup returns Object.prototype, which is truthy. The loose equality comparison then coerces Object.prototype to the string "[object Object]", causing the authentication check to succeed without valid credentials. This allows any unauthenticated user to gain full admin access. [2]
How can this vulnerability impact me? :
An unauthenticated attacker can exploit this vulnerability to gain full administrative access to the Tarkov Data Manager admin panel without any credentials. This compromises confidentiality, integrity, and availability of the system, allowing the attacker to control the application, potentially manipulate data, and disrupt services. Due to the critical severity (CVSS 9.8), it is recommended to audit logs for exploitation, assume compromise, and rotate secrets and passwords. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by auditing logs for exploitation attempts, specifically looking for POST requests to the /auth endpoint with the username set to "__proto__" and the password set to "[object Object]", which is the proof of concept for the authentication bypass. Network monitoring tools or log analysis can be used to search for such suspicious login attempts. For example, using grep on server logs: `grep 'POST /auth' /path/to/log | grep '__proto__'` to find attempts exploiting this vulnerability. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include auditing your logs for signs of exploitation and assuming compromise. Rotate all secrets and passwords related to the Tarkov Data Manager. Apply the fix by updating the authentication logic to use `Object.hasOwn(users, username)` to avoid prototype property access and replace loose equality (==) with strict equality (===) for password comparison. If a patch is not yet available, consider restricting access to the admin panel until the fix can be applied. [2, 1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to gain full admin access, potentially leading to unauthorized access to sensitive data. Such unauthorized access can result in violations of compliance requirements under standards like GDPR and HIPAA, which mandate strict controls on data confidentiality and integrity. Organizations affected should assume compromise, audit logs, and rotate secrets to mitigate compliance risks. [2]