Auth bypass in Fduflyer Droneaware-Node-Releases
CVE-2026-48117
DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an attacker could register an account using a victim's email address with an attacker-controlled password before the victim completed account activation. When the legitimate owner later activated the account, either by clicking the email verification link or by logging in via Google SSO, the attacker-set password became fully valid, enabling silent and persistent account takeover without any notification to the victim. The vulnerability was fixed server-side on 2025-05-20; no user action is required. Node binaries and self-hosted detection nodes are not affected. There are no workarounds; the fix was deployed server-side and no client-side mitigation is applicable.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (19.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 19.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Fduflyer Droneaware-Node-Releases — versions < server-2026-05-20
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-48117?
- CVE-2026-48117 is a medium-severity vulnerability in Fduflyer Droneaware-Node-Releases, classified under Improper Authentication. CVSS score: 6.8/10. Published 2026-06-17.
- How severe is CVE-2026-48117?
- Medium severity. CVSS v3 base score is 6.8 out of 10.