CVE-2026-105034
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated
CVSS
8.2
Alta
EPSS
0.6%
p47
KEV
—
Exploit Today
14
0-100
Publicado: 15 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-287 · CWE-306
0.6%EPSS · 30 dias0.6%
2026-10-162026-11-06
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
- github.comhttps://github.com/xn0tsa/your-secrets-are-safe-with-me
- takeonme.orghttps://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111001111111111000000000000000000010110111111111100000000000000000001110/
- www.theverge.comhttps://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-173706.4 MÉD—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed.6hCVE-2026-173588.2 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.6hCVE-2026-173268.1 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.6hCVE-2026-173248.3 ALT—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.6hCVE-2026-172406.5 MÉD—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper authentication. Authentication checks are not applied consistently, which could allow protected resources to be reached without valid credentials.6hCVE-2026-171589.9 CRÍ—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.6h