yezhihao jt808-server: Web Management API authentication bypass (CVE-2026-121926)

A missing authentication vulnerability exists in the Web Management API of the yezhihao jt808-server, specifically within the WebMvcConfig.addInterceptors function. The flaw allows remote, unauthenticated attackers to gain unauthorized access to the application's management interface. This vulnerability affects all versions of the product up to commit hash a07f68c466b560b97ef41edb8a4966469abdf83e. As the software is distributed via a rolling release model, there are no specific version numbers for patches or affected builds. The vendor has not responded to disclosure attempts.

Impact

Successful exploitation enables remote, unauthenticated access to the Web Management API, which may lead to unauthorized system configuration changes or data exposure within the jt808-server environment.

Recommendation

• Inventory all instances of jt808-server within your environment.
• Restrict access to the Web Management API at the network level using firewalls or VPNs until the vendor provides a remediation or the source code is patched manually.
• Monitor web server logs for suspicious, unauthenticated access attempts targeting API endpoints, particularly those associated with administrative functions.