This vulnerability (CWE-306) in Eclipse KUKSA - Databroker 0.5.0 allows an attacker holding a valid token with only read scope to misuse the OpenProviderStream API (kuksa.val.v2) by sending ProvideSignalRequest messages. The attacker can impersonate a signal provider and respond with attacker-controlled data to GetProviderValueRequest calls, causing other clients to receive forged signal data. The issue arises from missing authentication checks on the critical function that registers signal providers, enabling unauthorized data injection.

An attacker with a read-only JWT token can inject false data into the system by registering as a signal provider without proper authentication. This compromises the integrity of signal data delivered to other clients, potentially leading to incorrect system behavior or decision-making based on forged data. The vulnerability has a CVSS 4.0 score of 8.5, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by the Eclipse Foundation as of the provided data. Until a fix is available, restrict access to the affected API endpoints and monitor for unusual provider registrations if possible.