OpenRemote CVE-2026-66013 (CVSS 9.3): Unauthenticated Asset Takeover Details Disclosed

TL;DR

A critical OpenRemote vulnerability, CVE-2026-66013, carries a CVSS score of 9.3. It lets an unauthenticated attacker hijack an existing console asset through the public registration API. The maintainers published a full advisory, and version 1.26.2 fixes the flaw.

Why It Matters

OpenRemote is a widely used open-source IoT platform. Teams build device management, automation, and dashboards on top of it. Consoles handle push notifications for alerts and device status.

This OpenRemote vulnerability breaks that trust boundary. An attacker who overwrites a console’s push token can redirect, disable, or corrupt notification routing. If those notifications carry operational or tenant data, both confidentiality and integrity suffer. Multi-tenant deployments face the highest risk, since the update ignores realm boundaries.

How the Attack Works

The console registration API is public by design, so new consoles can register anonymously. However, the same endpoint handles two cases from one client-supplied id field. A new ID creates a console asset. An existing ID updates one instead.

In the update path, the backend loads the asset by ID and checks only that it is a console. It skips authentication, ownership, and realm checks. As a result, possession of an asset ID becomes enough authority to mutate server-side state. That pattern is a classic insecure direct object reference, exposed to unauthenticated callers.

Attack preconditions

The attacker needs network access to the endpoint and a valid console asset ID. No login and no user interaction are required. Asset IDs may leak through logs, URLs, API responses, backups, browser storage, or screenshots. Knowing the ID is the main practical hurdle.

Exploitation Status

The official GitHub security advisory documents the registration flow and the missing checks in detail. That write-up describes the exploit flow step by step, so the technical details are now public. No exploitation in the wild has been confirmed so far.

Affected Versions

OpenRemote versions 1.26.1 and earlier are affected. The issue was validated against release 1.25.0. Version 1.26.2 contains the fix.

Patch and Mitigation Steps

Update to OpenRemote 1.26.2 without delay. Grab it from the OpenRemote releases page. Patching is the real fix; the steps below reduce exposure meanwhile.

Restrict network access to the console registration endpoint where you can. Separate anonymous console creation from updates to existing assets. Require authentication and ownership checks before any update, and confirm the asset’s realm matches the request. A device-bound registration secret should gate re-registration, rather than a bare asset ID. Given the public advisory, treat this OpenRemote vulnerability as an urgent upgrade.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.