CVE-2026-8983 describes a critical vulnerability in Autel Maxi Charger Single firmware through version V1.03.51, where a hard-coded authentication token is embedded in the device. This token bypasses authorization checks on multiple management endpoints, allowing attackers to access privileged functionality without valid authentication. The vulnerability is categorized under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 4.0 base score of 10, indicating maximum severity. There is no vendor advisory or patch information available at this time, and the device is not a cloud service, so remediation depends on vendor action or firmware updates.

An attacker can leverage the hard-coded authentication token to bypass all authorization checks on multiple management endpoints of the affected device. This grants unauthorized privileged access, potentially allowing full control over the device's management functions. The vulnerability is remotely exploitable without authentication or user interaction, making it highly impactful and critical to device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is currently available, users should monitor Autel's communications for firmware updates addressing this issue. Until a patch is released, restricting network access to the device and isolating it from untrusted networks may reduce exposure.