Executive brief
Cosmos-Server, a self-hosted home server manager and secure gateway, contains a security flaw in its Constellation VPN component. An attacker can bypass authentication to view sensitive metadata about connected devices, such as internal IP addresses, device names, and user nicknames. This could allow unauthorized individuals to map out a private network, potentially leading to further targeted attacks or privacy violations.
Technical details
An authentication bypass exists in the `GET /cosmos/api/constellation/public-devices` endpoint of Cosmos-Server version 0.22.18. The vulnerability occurs because the `tokenMiddleware` and the specific endpoint handler fail to validate Bearer tokens that do not follow the internal 'cosmos_' prefix format. While the handler checks for the presence of an Authorization header and strips the 'Bearer ' prefix, it never verifies the token's validity or uses it to filter database results. Consequently, any non-empty string provided as a Bearer token grants access to device metadata, including nicknames, device names, VPN/internal IPs, and role flags. This issue is resolved in version 0.22.19 by implementing proper token validation.
Affected products
- azukaar Cosmos-Server 0.22.18
Timeline
- 2026-05-26: patched: Fix included in release v0.22.19
- 2026-07-28: advisory: GitHub Security Advisory GHSA-5fqm-cc34-fcf5 published
- 2026-07-28: disclosed: CVE-2026-49447 published to NVD