CVE Intelligence

EnergizeLab NestJS auth service vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting EnergizeLab NestJS auth service: 2 record(s), with affected versions and fixes.

CVE-2026-105040 High · 8.8 CWE-639 Oct 15, 2026
EnergizeLab Eilik User-ID Mass Assignment Account Takeover
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
CVE-2026-105034 High · 8.2 CWE-287 Oct 15, 2026
EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.