Auth bypass in Openremote

CVE-2026-66013

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.004 (35.8th percentile) — read the EPSS interpretation.