External risk intelligence

OpenRemote Authentication Bypass in Console Registration API

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-66013

The vulnerability resides in a console registration API, which is typically a network-accessible component in IoT and management platforms. As a service intended for registering and managing remote assets, this endpoint is commonly exposed to or reachable from the network, making it a likely target for external access in typical deployments.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An authentication bypass vulnerability in a console registration API for OpenRemote technology could allow unauthenticated attackers to update existing assets. This could potentially lead to the redirection or denial of notifications for legitimate consoles.

Attackers can alter console notifications without login.
This could impact device management and communication.
Confirm if OpenRemote technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable console registration API over the network. By sending specially crafted requests, they can bypass authentication and target existing console assets. This allows them to modify critical configuration details, such as push notification tokens, potentially redirecting communications or disrupting service for legitimate users.

No authentication required to access.
Update existing assets via API.
Redirect or deny notifications.

Live Threat

Current exploitation, exposure, and threat context

An authentication bypass in the console registration API could allow unauthenticated attackers to modify existing console assets. This could lead to the redirection or denial of push notifications intended for legitimate consoles.

Console assets and push tokens at risk.
Unauthenticated API access to update assets.
Notification delivery disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The authentication bypass vulnerability in the console registration API necessitates immediate attention from teams responsible for the OpenRemote platform. The first practical step is to identify all instances of the affected technology, determine their exposure and criticality, and pinpoint the accountable owner for remediation planning.

Application owners should coordinate remediation.
Verify network exposure and asset reachability.
Plan risk-based updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenRemote?

OpenRemote is an open-source IoT platform designed for managing and monitoring connected devices and assets. It provides a framework for building smart applications, such as energy management systems, fleet tracking, and building automation. The platform relies on components like the console registration API to link remote devices to the central management system, allowing for seamless communication and metadata exchange.

What does CVE-2026-66013 mean?

This CVE refers to an authentication bypass vulnerability, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). It means the software fails to verify if a user has permission to modify a specific asset. In this case, an attacker can manipulate the registration API to target and change settings for existing consoles without needing a valid login or ownership rights.

How can an attacker trigger this vulnerability?

An attacker can trigger this flaw by sending a specially crafted request to the console registration API. By providing the identifier of an existing console, they can bypass security checks to overwrite its metadata or push notification tokens. Simply querying the API for information without providing an asset ID or attempting to register a brand-new, non-existent asset will not trigger the modification of existing, legitimate console configurations.

Is my OpenRemote instance at risk?

Halo Surface Signal indicates that because this vulnerability exists within a console registration API, it is often network-accessible. If your instance is reachable from the internet, it is a likely target. You should determine if your deployment exposes this API endpoint externally or if it is restricted to internal segments, as external exposure significantly increases the likelihood of unauthorized interaction with your console assets.

What are the first steps to address this issue?

Begin by identifying all running instances of OpenRemote within your environment. Once you have a complete inventory, verify the network exposure of your console registration endpoints to understand which are reachable by unauthorized parties. Coordinate with the application owners for these systems to plan for updates during your next maintenance window, ensuring that you transition to a version of OpenRemote that is at least 1.26.2.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.