CVE-2026-66013
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Jul 25, 2026
Vendor
unknown
Description
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.