CVE-2026-48117 describes an improper authentication vulnerability (CWE-287) in the DroneAware centralized server. The flaw allowed an attacker to pre-register an account using a victim's email with an attacker-controlled password before the victim completed account activation. Upon victim activation via email verification or Google SSO, the attacker-set password remained valid, enabling persistent unauthorized access without alerting the victim. The vulnerability was addressed with a server-side fix deployed on 2025-05-20. Self-hosted nodes and binaries are not affected, and no client-side remediation is applicable.

Successful exploitation allows an attacker to silently and persistently take over a victim's DroneAware account by pre-registering it with the victim's email and attacker-controlled password. This results in unauthorized access with high confidentiality and integrity impact, but no availability impact. The victim receives no notification of the compromise. The vulnerability affects only the centralized DroneAware server and not self-hosted nodes.

The vulnerability was fixed by the vendor with a server-side patch deployed on 2025-05-20. No user action or client-side mitigation is required. There are no workarounds. Users and administrators should ensure they are using the official DroneAware service where the fix is applied.