CVE-2026-66013
Received Received - Intake

Authentication Bypass in OpenRemote Console API

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: VulnCheck

Description
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-66013
EUVD
EUVD-2026-49044

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openremote openremote to 1.26.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenRemote before version 1.26.2 has an authentication bypass flaw in its console registration API. This allows unauthenticated attackers to update existing console assets by providing a known asset identifier. Attackers can overwrite push notification tokens and console metadata without needing authentication or ownership verification.

Impact Analysis

Attackers could redirect push notifications meant for legitimate consoles to their own systems, potentially intercepting sensitive alerts or denying service to authorized users. They might also modify console metadata to disrupt operations or impersonate legitimate devices.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations if notifications or data integrity are compromised.

Mitigation Strategies

Immediately upgrade OpenRemote to version 1.26.2 or later to address the authentication bypass in the console registration API. Ensure no unauthenticated requests are allowed to update existing console assets or overwrite push notification tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart