Verified reproduction
CVE-2026-66013: OpenRemote console registration authentication bypass via known asset identifier
CVE-2026-66013 is verified against openremote · github affected versions: OpenRemote <= 1.26.1; the advisory says the flaw was directly validated on 1.25.0. fixed version: OpenRemote 1.26.2 and later. vulnerability class: Auth Bypass This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00300.
Severity CRITICAL
Confidence HIGH
Reproduced in 35m 36s
Tool calls 209
Spend $13.73
Affected OpenRemote <= 1.26.1; the advisory says the flaw was directly validated on 1.25.0.
Fixed in OpenRemote 1.26.2 and later.
$
pruva-verify REPRO-2026-00300 or
curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00300/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Run in a VM or disposable container. This exploits a real vulnerability.
OpenRemote through 1.26.1 allows an unauthenticated caller to overwrite an existing console asset by submitting its known asset ID to the public console registration flow.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.
bundle/repro/reproduction_steps.sh18.3 KBbundle/repro/rca_report.md10.1 KBbundle/repro/runtime_manifest.json2.0 KBbundle/logs/reproduction_steps.log2.5 KBbundle/logs/vulnerable-attempt-1-service.log92.7 KBbundle/logs/fixed-attempt-1-service.log91.0 KBbundle/artifacts/openremote-console-cve-2026-66013/image-identities.json0.6 KBbundle/artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-1/attacker-overwrite.request.txt0.6 KBbundle/artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-1/attacker-overwrite.response.headers0.1 KBbundle/artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-1/attacker-overwrite.response.json0.5 KBbundle/artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-1/persisted-state.json0.1 KBbundle/artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-2/persisted-state.json0.1 KBbundle/artifacts/openremote-console-cve-2026-66013/fixed-attempt-1/attacker-overwrite.response.headers0.1 KBbundle/artifacts/openremote-console-cve-2026-66013/fixed-attempt-1/attacker-overwrite.response.json6.8 KBbundle/artifacts/openremote-console-cve-2026-66013/fixed-attempt-1/persisted-state.json0.1 KBbundle/artifacts/openremote-console-cve-2026-66013/fixed-attempt-2/persisted-state.json0.1 KBbundle/repro/validation_verdict.json0.8 KB