CVE-2026-48117 describes an improper authentication vulnerability (CWE-287) in the centralized DroneAware server backing droneaware.io. The flaw allowed an attacker to pre-register an account using a victim’s email and an attacker-chosen password before the victim completed account activation. When the legitimate user later activated the account via email verification or Google SSO, the attacker’s password remained valid, enabling persistent, silent account takeover without alerting the victim. This vulnerability was addressed with a server-side fix deployed on 2025-05-20. The vulnerability does not affect node binaries or self-hosted detection nodes.

Successful exploitation allows an attacker to silently and persistently take over a victim’s DroneAware account by pre-registering it with the victim’s email and attacker-controlled password. This compromises confidentiality and integrity of the victim’s account without their knowledge. There is no impact on availability. The vulnerability affects only the centralized DroneAware server and not client-side components.

The vulnerability was fixed by a server-side update deployed on 2025-05-20. No user action or client-side mitigation is required or applicable. There are no workarounds. Users and administrators should ensure they are using the updated centralized DroneAware service.