Description
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openremote | openremote | < 1.26.2 | 1.26.2 |
References
- GitHub Security Advisory (GHSA-gpfc-h59v-63cv) vendor-advisory
- VulnCheck Advisory: OpenRemote before 1.26.2 Authentication Bypass via Console Registration third-party-advisory