CVE-2026-105034: CWE-306 Missing Authentication for Critical Function in EnergizeLab NestJS auth service

The EnergizeLab NestJS auth service (version 1.8.2) suffers from a missing authentication control for a critical function that issues device tokens. Specifically, the service issues tokens for arbitrary robot serial numbers without verifying the requester's identity. This flaw (CWE-306) enables an unauthenticated remote attacker to obtain valid device tokens for any serial number, allowing them to act as that device in interactions with cloud services. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact.

An unauthenticated attacker can impersonate any device by obtaining a valid device token for any robot serial number. This compromises the integrity of the cloud services relying on device authentication, potentially allowing unauthorized actions or commands to be executed as if from the legitimate device. Confidentiality impact is low, and availability is not affected.

No patch or official fix is currently available for this vulnerability. Since this is not a cloud-hosted service, vendor-managed remediation does not apply. Users of version 1.8.2 should monitor the vendor advisory for updates and apply any forthcoming patches promptly. Until a fix is released, restricting network access to the auth service and implementing additional authentication controls externally may help mitigate risk.