CVE-2026-126768 OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag
CriticalCVSS 9.3
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpsTree Solutions REMS | <= 1.0.0 | No fix listed |
References
- gist.github.com exploit technical-description
- REMS by OpsTree Product Page product
- VulnCheck Advisory: OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag third-party-advisory