{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/ikaros/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ikaros:ikaros:1.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ikaros:ikaros:1.2.5:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-110097"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ikaros (1.2.0 - 1.2.5)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","ikaros","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Ikaros"],"content_html":"\u003cp\u003eIkaros versions 1.2.0 through 1.2.5 contain a critical authentication bypass vulnerability (CVE-2026-110097) that enables attackers who possess a legitimate user password to circumvent Multi-Factor Authentication (TOTP). The vulnerability stems from improper handling of temporary tokens issued during the initial login phase. An attacker can intercept or reuse a temp token obtained from the '/jwt/apply' endpoint. By presenting this token as a valid bearer JWT or refreshing it, the attacker can successfully bypass the second factor of authentication. This flaw allows for full account takeover, including the acquisition of master administrator privileges, significantly increasing the risk of lateral movement and data exfiltration within the affected environment. Organizations utilizing Ikaros should immediately restrict access to the application interface and prioritize the application of vendor-supplied patches to remediate this authentication logic flaw.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized actors to bypass security controls, leading to total account compromise. In environments where master administrator accounts are targeted, attackers can gain full control over the application, modify configurations, and access sensitive data. Given the severity of the authentication bypass, the potential for unauthorized access is high for all exposed instances of Ikaros within the 1.2.0 to 1.2.5 version range.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize the immediate upgrade of all Ikaros instances to a patched version that resolves CVE-2026-110097.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious activity targeting the '/jwt/apply' endpoint, specifically looking for anomalous sequences of HTTP Basic login followed by token reuse as a bearer token.\u003c/li\u003e\n\u003cli\u003eRestrict external access to the Ikaros login portal via network-level controls until patches are verified and applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:37:12Z","date_published":"2026-10-13T18:37:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ikaros-auth-bypass/","summary":"Ikaros versions 1.2.0 through 1.2.5 are vulnerable to an authentication bypass where attackers with valid passwords can circumvent TOTP requirements by manipulating temporary login tokens.","title":"Authentication Bypass Vulnerability in Ikaros","url":"https://feed.craftedsignal.io/briefs/2026-10-ikaros-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Ikaros","version":"https://jsonfeed.org/version/1.1"}