CVE-2026-71854: CWE-306: Missing Authentication for Critical Function in OpenAEV-Platform openaev
Description
OpenAEV-Platform versions prior to 2.260622.0 have a missing authentication vulnerability in the /api/player/** lessons endpoints. These endpoints accept a userId query parameter without verifying the caller's identity or membership in the exercise. This allows unauthenticated attackers who know an exercise UUID to read sensitive lesson questions and answers, including author identities, and to create or overwrite answers attributed to arbitrary users. The issue is patched in version 2.260622.0.
CVSS v3.1
Score 8.2high
Affected software
OpenAEV-Platform
openaev
pkg:github/openaev-platform/openaevRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-71854 describes a missing authentication vulnerability (CWE-306) in OpenAEV-Platform before version 2.260622.0. The /api/player/** lessons endpoints do not require authentication and trust a client-supplied userId parameter without verification. This flaw enables unauthenticated clients who know an exercise UUID to access and manipulate lesson content and author information improperly. The vulnerability is addressed in version 2.260622.0.
Potential Impact
An unauthenticated attacker can read sensitive lesson-learned questions and answers, including the identity of each answer's author. Additionally, the attacker can create or overwrite answers attributed to arbitrary users, potentially compromising data integrity and confidentiality. There is no impact on availability reported. The CVSS score is 8.2 (high severity) reflecting high confidentiality impact and low integrity impact.
Mitigation Recommendations
Upgrade OpenAEV-Platform to version 2.260622.0 or later, which contains a patch that enforces proper authentication and authorization checks on the /api/player/** lessons endpoints. Until upgraded, restrict access to these endpoints to trusted users or networks if possible. Patch status is confirmed by the vendor advisory indicating the fix in version 2.260622.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-07T18:26:53.523Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfe7382cdf04f656ad192f
Added to database: 10/14/2026, 20:34:00 UTC
Last enriched: 10/14/2026, 20:48:15 UTC
Last updated: 10/14/2026, 20:49:11 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.