CVE-2026-126768: OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag
OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled islocalauth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and islocalauth true to gain SuperUser administrative access.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
OpsTree REMS installations through version 1.0.0 are affected where the login API endpoint is reachable by an attacker. Exploitation is network-based and does not require an existing account or user interaction.
What does an attacker need to send to exploit the bypass?
An attacker can submit a POST request to /api/v1/user/login/ for the admin account, provide an invalid password, and set the client-controlled is_local_auth field to true. This can cause the application to issue a valid JWT and grant SuperUser administrative access.
Does exploitation require valid credentials?
No. The described exploit uses an invalid password and does not require prior privileges, making it an unauthenticated authentication bypass.
How can I determine whether an exploitation attempt occurred?
Review requests to /api/v1/user/login/ for attempts targeting the admin account that include is_local_auth set to true, especially where the supplied password was invalid. Also investigate JWT issuance and administrative sessions associated with such login events.