Auth bypass in Tarkov Data Manager
CVE-2026-21854
The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property access vulnerability, combined with loose equality type coercion. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.
Vulnerability class: Broken Authentication
EPSS: 0.004 (32.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Tarkov Tarkov_data_manager
- The-hideout Tarkov-data-manager — versions <= 2.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-21854?
- CVE-2026-21854 is a critical-severity vulnerability in Tarkov Data Manager, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-01-07.
- How severe is CVE-2026-21854?
- Critical severity. CVSS v3 base score is 9.8 out of 10.