CVE-2026-66013

9.3 criticalEPSS 0.7%

Critical (9.3). EPSS 0.7% chance of exploitation in the next 30 days.

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-07-25
Modified: 2026-07-30
Record from: the NVD, synced 2026-10-19

References

https://github.com/openremote/openremote/security/advisories/GHSA-gpfc-h59v-63cv
https://www.vulncheck.com/advisories/openremote-before-authentication-bypass-via-console-registration
https://github.com/openremote/openremote/security/advisories/GHSA-gpfc-h59v-63cv

Check your stack JSON