Auth bypass in Tarkov Tarkov_data_manager
CVE-2026-21854
The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager a…
Vulnerability class: Broken Authentication
EPSS: 0.004 (31.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Tarkov Tarkov_data_manager
- The-hideout Tarkov-data-manager — versions <= 2.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-21854?
- CVE-2026-21854 is a critical-severity vulnerability in Tarkov Tarkov_data_manager, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-01-07.
- How severe is CVE-2026-21854?
- Critical severity. CVSS v3 base score is 9.8 out of 10.