CVE-2026-42084 is a vulnerability in OpenC3 COSMOS where the password change functionality does not verify the old password but accepts a valid session token instead. This allows an attacker with a valid session token to change the password of an account without knowing the original password, facilitating account persistence and denial of access to legitimate users. The vulnerability affects versions prior to 6.10.5 and versions from 7.0.0.pre.rc1 up to but not including 7.0.0-rc3. The issue is fixed in versions 6.10.5 and 7.0.0-rc3.

An attacker who has already obtained a valid session token can exploit this vulnerability to change account passwords without the old password, gaining persistent access to the account, including administrative accounts. This can prevent legitimate users from accessing their accounts, potentially leading to account takeover scenarios. There are no known exploits in the wild as of the published date.

Upgrade OpenC3 COSMOS to version 6.10.5 or later, or to version 7.0.0-rc3 or later, where this vulnerability has been patched. Since this is not a cloud service, remediation requires applying the official software update. Patch status is confirmed by the vendor's versioning information.