Vulnerabilidades do EnergizeLab NestJS auth service
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam EnergizeLab NestJS auth service: 2 registro(s), com versões afetadas e correções.
CVE-2026-105040
Alta · 8.8
CWE-639 15/10/2026
EnergizeLab Eilik User-ID Mass Assignment Account Takeover
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
CVE-2026-105034
Alta · 8.2
CWE-287 15/10/2026
EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.