REMS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/rems/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 20:04:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpsTree REMS: Authentication bypass vulnerability (CVE-2026-126768)https://feed.craftedsignal.io/briefs/2026-11-opstree-rems-auth-bypass-cve-2026-126768/Wed, 11 Nov 2026 20:04:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-opstree-rems-auth-bypass-cve-2026-126768/OpsTree REMS through version 1.0.0 contains an authentication bypass vulnerability allowing unauthenticated attackers to obtain valid JWTs and gain administrative access via parameter manipulation.OpsTree REMS through version 1.0.0 contains an authentication bypass vulnerability. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and the is_local_auth field set to true to bypass authentication.

Impact

Successful exploitation allows an unauthenticated attacker to obtain a valid JWT for an administrative account, resulting in SuperUser administrative access.

Recommendation

Monitor logs for the POST /api/v1/user/login/ request pattern where the client-controlled is_local_auth field is set to true.

]]>criticaladvisory