# CVE-2026-103057: AiSOC authentication bypass in realtime service internal endpoints

Source: https://junglewise.ai/threats/cve-2026-103057-aisoc-versions-5-1-0-before-12-0-0-contain-an-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-103057 · Severity: medium · CVSS 4.3 · Published 2026-09-30

AiSOC is a security operations center platform that aggregates alerts and events across an organization's infrastructure. Versions 5.1.0 through 11.x contain two authentication flaws in the real-time notification service that allow unauthenticated attackers to inject arbitrary security alerts and push notifications to any tenant on the platform without credentials, potentially causing widespread false alarms or social engineering attacks against the organization.

## Quick answers

**Is CVE-2026-103057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103057 being exploited in the wild.

**How severe is CVE-2026-103057?** Medium severity, with a CVSS score of 4.3, published 30 September 2026.

**Which products and versions are affected?** beenuar AiSOC 5.1.0 to 11.x.

**Is there a fix for CVE-2026-103057?** A patch was published on 2026-09-27: Fix commit 2f0e954 available; requires version 12.0.0 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103057 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-103057?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Two related authentication bypass vulnerabilities exist in the realtime service: (1) the POST /internal/agent-event and POST /internal/push endpoints lack proper authentication checks due to an unset INTERNAL_TOKEN environment variable, allowing any network-adjacent caller to inject events; (2) ticket validation uses a hardcoded constant (CWE-798) rather than a properly configured HMAC secret, enabling forged JWT claims with arbitrary tenant identifiers. Attackers can inject malicious events into WebSocket and Redis SSE channels or send spoofed notifications to registered devices without authentication.

## Affected products

- beenuar AiSOC 5.1.0 to 11.x

## Timeline

- 2026-09-30: disclosed
- 2026-09-27: patched: Fix commit 2f0e954 available; requires version 12.0.0 or later

## References

- [https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/index.ts](https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/index.ts)
- [https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43](https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43)