Executive brief
OpenRemote, an open-source IoT platform, contains a security flaw in how it handles mobile and web console registrations. An attacker who knows a specific console's ID can remotely modify its settings without a password. This allows unauthorized parties to hijack push notifications, potentially intercepting sensitive alerts or preventing legitimate users from receiving critical system updates.
Technical details
An authentication bypass exists in the OpenRemote console registration API due to an Insecure Direct Object Reference (IDOR) flaw (CWE-639). The endpoint, intended for anonymous registration of new consoles, fails to validate ownership or require authentication when a request provides an ID belonging to an existing console asset. By sending a crafted POST request to /api/console/register with a known asset ID, an unauthenticated attacker can overwrite console provider data and metadata. This enables the replacement of push notification tokens (FCM/APNs), allowing the redirection of sensitive notification traffic to an attacker-controlled device or causing a denial of service for legitimate notifications. The vulnerability is patched in version 1.26.2.
Affected products
- OpenRemote OpenRemote < 1.26.2
Timeline
- 2026-07-13: advisory: GitHub Security Advisory published
- 2026-07-25: disclosed: CVE published to NVD