CVE-2026-124573: logseq Local HTTP API server.cljs validate-auth-token missing authentication
A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which installations are known to be affected?
The affected versions identified are Logseq 2.0.1 and 2.0.2. The issue is in the Local HTTP API component's validate-auth-token function.
Does exploitation require credentials or user interaction?
No credentials or user interaction are required according to the provided vector. The attack is described as remotely performable with low attack complexity.
Is exploit code available?
Yes. A public exploit has been reported, so affected deployments should be treated as having increased exploitation risk.
Is a vendor fix available?
No fix is identified in the provided information. The project was notified through an issue report but had not responded at the time of publication.