Critical severity · published Jul 25, 2026
CVE-2026-66013
OpenRemote before 1.26.2 Authentication Bypass via Console Registration
9.3
CVSS
0.7%
EPSS
No
On KEV
Description
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openremote · openremote
before 1.26.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66013
github.com
https://github.com/openremote/openremote/security/advisories/GHSA-gpfc-h59v-63cv
www.vulncheck.com
https://www.vulncheck.com/advisories/openremote-before-authentication-bypass-via-console-registration
More from openremote
9.9
CVE-2026-39842
OpenRemote is Vulnerable to Expression Injection
9.8
CVE-2022-31860
An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule
8.8
CVE-2026-62238
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
8.5
CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
8.1
CVE-2026-56784
OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint