A severe authentication bypass vulnerability (CVE-2026-66013) has been discovered in the console registration API of OpenRemote products prior to version 1.26.2. This vulnerability could allow an unauthenticated attacker to exploit known asset identifiers to update existing console assets, overwriting push notification tokens and console metadata without authentication. This could lead to legitimate console notifications being redirected or denied delivery. This vulnerability was announced on July 25, 2026, and requires prompt action.
Immediate Actions to Take
- ✓Update OpenRemote to version 1.26.2 or later.
- ✓Restrict access to the console registration API until the update is complete.
- ✓Monitor system logs for suspicious console asset changes or signs of notification redirection.
Vulnerability Overview and Scope of Impact
CVE-2026-66013 is a vulnerability stemming from a flaw in the authentication logic of OpenRemote's console registration API. Attackers can update console assets without authentication, posing a risk of tampering with critical configuration information. As an IoT platform managing diverse devices and services, OpenRemote, if this vulnerability is exploited, could lead to widespread impacts such as unauthorized control of connected IoT devices, data breaches, and denial of service.
Specific Impacts and Attack Scenarios
For instance, an attacker could identify an asset identifier used by a legitimate console and use that identifier to register a malicious push notification token, redirecting notifications intended for the legitimate user to a device they control. Furthermore, by tampering with console metadata, attackers could cause disruption to system operations or establish a foothold for future, more severe attacks. Such an authentication bypass is extremely dangerous as an initial access vector allowing system intrusion.
Response Procedures and Verification Methods
Refer to the official OpenRemote documentation and follow the upgrade procedures to version 1.26.2 or later. After upgrading, it is crucial to verify that the system is functioning correctly, especially ensuring that console registration and notification functions are normal. Additionally, it is recommended to thoroughly analyze security logs for any suspicious console asset change history.
# Check OpenRemote version (command may vary depending on environment)
# Check README or version file in OpenRemote installation directory
# Alternatively, check version information displayed in the administration panel
# Example: Version check in Docker environment
# docker exec <openremote_container_name> /opt/openremote/bin/openremote.sh version
# Refer to official documentation for upgrade procedures.
# docker-compose pull
# docker-compose up -d