Microsoft UFO's constellation client in version 3.0.1-4-ge2626659 tracks pending task responses solely by session_id and does not verify that the TASK_END message comes from the device originally assigned the task. Although the pending task record stores the expected device ID, the completion logic ignores this binding. Consequently, an authenticated peer device can forge a TASK_END message with a matching session_id, causing the constellation to accept the response and inject attacker-controlled result data into the victim device's pending task. This constitutes an authentication bypass via capture-replay, categorized under CWE-294 and CWE-345.

The vulnerability allows an authenticated attacker with access to the constellation network to inject forged task completion messages for tasks assigned to other devices. This can lead to integrity violations by substituting legitimate task results with attacker-controlled data. The impact is limited to integrity compromise and partial availability degradation (low availability impact). Confidentiality is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict authenticated peer device access to trusted entities only and monitor for anomalous task completion messages if possible.