{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ayezhihaojt808_server/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yezhihao:jt808_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-121926"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["jt808-server (\u003c= a07f68c466b560b97ef41edb8a4966469abdf83e)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","web-application","cve-2026-121926"],"_cs_type":"advisory","_cs_vendors":["yezhihao"],"content_html":"\u003cp\u003eA missing authentication vulnerability exists in the Web Management API of the yezhihao jt808-server, specifically within the WebMvcConfig.addInterceptors function. The flaw allows remote, unauthenticated attackers to gain unauthorized access to the application's management interface. This vulnerability affects all versions of the product up to commit hash a07f68c466b560b97ef41edb8a4966469abdf83e. As the software is distributed via a rolling release model, there are no specific version numbers for patches or affected builds. The vendor has not responded to disclosure attempts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation enables remote, unauthenticated access to the Web Management API, which may lead to unauthorized system configuration changes or data exposure within the jt808-server environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of jt808-server within your environment.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Web Management API at the network level using firewalls or VPNs until the vendor provides a remediation or the source code is patched manually.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious, unauthenticated access attempts targeting API endpoints, particularly those associated with administrative functions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T18:51:14Z","date_published":"2026-11-04T18:51:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-yezhihao-jt808-auth-bypass/","summary":"A missing authentication vulnerability in the jt808-server Web Management API allows remote attackers to bypass security controls via the WebMvcConfig.addInterceptors function.","title":"yezhihao jt808-server: Web Management API authentication bypass (CVE-2026-121926)","url":"https://feed.craftedsignal.io/briefs/2026-11-yezhihao-jt808-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:yezhihao:jt808_server:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}