CyberRota Analysis
AI-GeneratedOpenRemote versions prior to 1.26.2 are vulnerable to an authentication bypass in the console registration API, enabling unauthenticated attackers to manipulate existing console assets using known identifiers. This flaw allows attackers to overwrite push notification tokens and console metadata, potentially redirecting notifications or disrupting service for legitimate users. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.