CVE-2026-21854: Tarkov Data Manager Authentication Bypass vulnerability
The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property access vulnerability, combined with loose equality type coercion. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21854?
CVE-2026-21854 is classified as a critical vulnerability due to its potential for unauthorized admin access.
How does CVE-2026-21854 occur?
CVE-2026-21854 occurs when an attacker exploits an authentication bypass vulnerability in the login endpoint.
What versions of Tarkov Data Manager are affected by CVE-2026-21854?
CVE-2026-21854 affects versions of Tarkov Data Manager prior to January 2, 2025.
How do I fix CVE-2026-21854?
To fix CVE-2026-21854, update the Tarkov Data Manager to a version released on or after January 2, 2025.
What can an attacker do if they exploit CVE-2026-21854?
By exploiting CVE-2026-21854, an attacker can gain full admin access to the Tarkov Data Manager admin panel.