CVE-2026-66013: OpenRemote Auth Bypass Vulnerability

CVE-2026-66013 Overview

CVE-2026-66013 is an authentication bypass vulnerability affecting OpenRemote versions prior to 1.26.2. The flaw resides in the console registration API, which fails to validate authentication or asset ownership before processing update requests. Unauthenticated remote attackers can modify existing console assets by supplying a known asset identifier. Successful exploitation lets attackers overwrite push notification tokens and console metadata, redirecting notifications to attacker-controlled destinations or denying legitimate delivery. The vulnerability is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers can hijack push notification tokens across OpenRemote consoles, redirecting or blocking notifications and tampering with console metadata over the network.

Affected Products

OpenRemote versions before 1.26.2
OpenRemote console registration API endpoint
Deployments exposing the OpenRemote Manager to untrusted networks

Discovery Timeline

2026-07-25 - CVE-2026-66013 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66013

Vulnerability Analysis

OpenRemote registers client consoles as assets through a dedicated registration API. The API accepts update requests referencing an existing console asset by its identifier. The endpoint does not require authentication and does not verify that the caller owns or controls the referenced asset. Attackers who obtain or guess a valid console asset identifier can submit update payloads that overwrite properties on the target console, including push notification registration tokens. This turns a routine registration flow into an authorization bypass affecting confidentiality and integrity of downstream notification delivery.

Root Cause

The root cause is missing authorization enforcement on a user-controlled key. The console registration handler treats the client-supplied asset identifier as sufficient proof of ownership. No session token, API key, or ownership check is applied before persisting the update. This pattern maps directly to [CWE-639], where access decisions rely on values an attacker can supply or discover.

Attack Vector

Exploitation requires only network access to the OpenRemote Manager and knowledge of a valid console asset identifier. Attackers can enumerate identifiers through information leaks, log exposure, or predictable identifier formats. Once armed with a valid identifier, an attacker issues a crafted registration update over HTTPS containing an attacker-owned push notification token and modified metadata. Subsequent notifications intended for the legitimate console are delivered to the attacker or silently dropped.

No verified proof-of-concept code is published at this time. Refer to the GitHub Security Advisory and the VulnCheck Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-66013

Indicators of Compromise

Unexpected changes to push notification tokens on console assets without a corresponding legitimate registration event.
Console asset metadata modifications originating from IP addresses that are not associated with enrolled devices.
Notification delivery failures or user reports of missing alerts from OpenRemote-managed consoles.
Unauthenticated HTTP requests to the console registration endpoint targeting existing asset identifiers.

Detection Strategies

Review OpenRemote Manager access logs for POST or PUT requests to the console registration endpoint that lack an authenticated session context.
Correlate console asset update events with the source IP and user agent history for each registered device.
Alert on rapid successive updates to pushIdentifier or notification token fields across multiple console assets.

Monitoring Recommendations

Forward OpenRemote application and reverse proxy logs to a centralized SIEM for continuous inspection.
Baseline normal console registration volume and alert on deviations that suggest identifier enumeration.
Monitor outbound push notification delivery metrics for unexpected drops or destination changes.

How to Mitigate CVE-2026-66013

Immediate Actions Required

Upgrade all OpenRemote deployments to version 1.26.2 or later without delay.
Restrict network exposure of the OpenRemote Manager to trusted networks or authenticated reverse-proxy tiers.
Rotate push notification tokens for all registered consoles after upgrading to invalidate any attacker-planted values.
Audit console assets for unauthorized metadata or token changes since the vulnerable version was deployed.

Patch Information

The OpenRemote maintainers released version 1.26.2 to remediate CVE-2026-66013. The fix enforces authentication and ownership validation on the console registration API before allowing updates to existing console assets. Full remediation details are documented in the GitHub Security Advisory GHSA-gpfc-h59v-63cv.

Workarounds

Place the OpenRemote Manager behind a reverse proxy that requires authentication for the console registration path until the patch is applied.
Apply network access control lists limiting the registration endpoint to known device subnets.
Temporarily disable push notification workflows in high-risk environments if patching cannot be completed immediately.

bash

# Example nginx location block restricting the console registration endpoint
# to an internal management subnet as a temporary compensating control.
location /api/master/asset/console {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://openremote-manager:8080;
}