Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · 8 min 156 bronnen 2 kritiek 34 vandaag
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2026-126768

CRITICAL · 9.8 CVSS Gepubliceerd: CWE-287

Beschrijving

OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.

References