Is CVE-2026-66013 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66013 being exploited in the wild.

How severe is CVE-2026-66013?

Informational severity, with a CVSS score of 9.3, published 25 July 2026.

Is there a fix for CVE-2026-66013?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66013 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-66013?

Check whether you run OpenRemote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66013: OpenRemote authentication bypass in console registration API

CVE-2026-66013 · Severity: info · CVSS 9.3 · Published 2026-07-25

OpenRemote, an open-source IoT platform, contains a security flaw in how it handles mobile and web console registrations. An attacker who knows a specific console's ID can remotely modify its settings without a password. This allows unauthorized parties to hijack push notifications, potentially intercepting sensitive alerts or preventing legitimate users from receiving critical system updates.

Technologies: OpenRemote. Vendors: OpenRemote.

Quick answers

Is CVE-2026-66013 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66013 being exploited in the wild.
How severe is CVE-2026-66013?: Informational severity, with a CVSS score of 9.3, published 25 July 2026.
Which products and versions are affected?: OpenRemote < 1.26.2.
Is there a fix for CVE-2026-66013?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66013 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-66013?: Check whether you run OpenRemote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass exists in the OpenRemote console registration API due to an Insecure Direct Object Reference (IDOR) flaw (CWE-639). The endpoint, intended for anonymous registration of new consoles, fails to validate ownership or require authentication when a request provides an ID belonging to an existing console asset. By sending a crafted POST request to /api/console/register with a known asset ID, an unauthenticated attacker can overwrite console provider data and metadata. This enables the replacement of push notification tokens (FCM/APNs), allowing the redirection of sensitive notification traffic to an attacker-controlled device or causing a denial of service for legitimate notifications. The vulnerability is patched in version 1.26.2.

Affected products

OpenRemote OpenRemote < 1.26.2

Timeline

2026-07-13: advisory: GitHub Security Advisory published
2026-07-25: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.