Quick answers
- Is CVE-2026-5557 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-5557 being exploited in the wild.
- How severe is CVE-2026-5557?
- Medium severity, with a CVSS score of 6.3, published 5 April 2026.
- Which products and versions are affected?
- Badlogic Pi-Mono up to 0.58.4.
- Is there a fix for CVE-2026-5557?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-5557 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-5557?
- Check whether you run Badlogic Pi-Mono at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authentication bypass vulnerability (CWE-288/CWE-287) exists in the pi-mom Slack Bot component of badlogic pi-mono up to version 0.58.4. The issue is located in the processing logic within 'packages/mom/src/slack.ts'. A remote attacker with low privileges can exploit this by using an alternate channel to bypass intended authentication requirements. Successful exploitation allows the attacker to perform actions or access data as an authenticated user. A public exploit (PoC) is reportedly available, and the vendor has not yet released a patch or responded to the disclosure.
Affected products
- badlogic pi-mono up to 0.58.4
Timeline
- 2026-03-19: disclosed: Initial discovery/issue opened on GitHub
- 2026-04-05: advisory: CVE published and VulDB entry created