VULNERABILITY INTELLIGENCE
CVE-2026-66013
EPSS probability0.68%
CISA KEVNot currently listed
Published2026-07-25
Last modified2026-07-30
Description
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.
Weakness classification
- disclosure@vulncheck.com: CWE-639