Auth bypass in Openremote

CVE-2026-66013

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite…

Vulnerability class: IDOR (Insecure Direct Object Reference)