{"id":"CVE-2026-121926","kind":"vulnerability","aliases":["CVE-2026-121926"],"related":[],"title":"jt808-server: Web Management API skips authentication, reachable remotely","description":"A vulnerability was detected in yezhihao jt808-server up to a07f68c466b560b97ef41edb8a4966469abdf83e. Affected is the function WebMvcConfig.addInterceptors of the component Web Management API. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"yezhihao jt808-server, a Java server for GPS vehicle terminals, has a flaw in its web management interface where the authentication interceptor is not applied. A remote attacker can reach the management API without logging in, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"jt808-server","fixed":[],"affected":"master up to and including a07f68c466b560b97ef41edb8a4966469abdf83e (rolling release, no versions)","ecosystem":"github"}],"ecosystems":[],"tags":["gps-tracking","java","jt808-server","no-fix","package","poc-public","self-hosted"],"not_affected_if":["auth-proxy-in-front","management-api-not-exposed"],"how_to_check":"- Check whether you run yezhihao/jt808-server (GitHub/Gitee) and which commit it was built from (git rev-parse HEAD). VulDB names a07f68c466b560b97ef41edb8a4966469abdf83e (2026-07-23, a dependency bump to 4.0.6) as the last affected commit; the project has no release versions.\n- From a machine that is not trusted, request the management API without credentials, for example the OpenAPI/Swagger pages (/doc.html, /swagger-ui/index.html) or the device command routes such as POST /device/8103 on the web port (the README shows 8100 or 8000). Any answer other than 401/403 means the API is open.\n- Read WebMvcConfig.addInterceptors in your build and confirm an authentication interceptor covers all routes. The public exploit is a gist linked from VulDB; I could not retrieve its address, so the exact route is unconfirmed.","fix":null,"status":"open","published_at":"2026-11-04T17:17:35+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","triaged_at":"2026-11-04T17:28:44+00:00","updated_at":"2026-11-04T17:30:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T17:28:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"jt808-server: Web Management API skips authentication, reachable remotely","impact":"high","summary":"yezhihao jt808-server, a Java server for GPS vehicle terminals, has a flaw in its web management interface where the authentication interceptor is not applied. A remote attacker can reach the management API without logging in, and a public exploit exists.","audience":"developers","category":"package","nicknames":[],"who_cares":["jt808-server","java","gps-tracking","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker reaches management API without credentials","analyst_note":"Confirm whether the project has any fixed commit or maintainer response, and which routes the web management API exposes; the sources say the vendor never responded.","how_to_check":"- Check whether the `jt808-server` project is deployed and which commit it was built from; the sources name `a07f68c466b560b97ef41edb8a4966469abdf83e` as the last affected commit.\n- Look for the Web Management API (WebMvcConfig.addInterceptors) in the deployed code and confirm whether any login interceptor covers its routes.\n- unknown for a fixed version, since the project has no version numbers.","plain_action":"","needs_analyst":true,"not_affected_if":["management-api-not-exposed","auth-proxy-in-front"],"who_is_affected":"Teams running the yezhihao jt808-server project, which handles GPS vehicle terminal connections, with its web management API exposed on a network. The sources say the interceptor configuration in WebMvcConfig.addInterceptors is the weak point, so deployments that put the management API behind their own authentication layer may be less exposed. The sources do not say which deployments are safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4216,"output_tokens":647,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the project has any fixed commit or maintainer response, and which routes the web management API exposes; the sources say the vendor never responded.","search":"'-121926':13A,16A '-2026':12A,15A 'a07f68c466b560b97ef41edb8a4966469abdf83e':90C 'affect':91C,142C 'api':6A,70B,101C 'appli':62B 'attack':65B,109C 'authent':8A,58B,107C 'basi':130C 'compon':98C 'consequ':134C 'contact':149C 'continu':132C 'cve':11A,14A 'deliveri':133C 'detail':139C 'detect':82C 'disclosur':153C 'earli':150C 'either':141C 'ensur':131C 'exist':78B 'exploit':77B,115C 'fix':29B 'flaw':50B 'function':94C 'gps':21B,45B 'gps-track':20B 'host':36B 'interceptor':59B 'interfac':55B 'java':23B,42B 'jt808':2A,18A,25B,39B,86C 'jt808-server':1A,17A,24B,38B,85C 'launch':112C 'log':72B 'manag':5A,54B,69B,100C 'manipul':103C 'may':110C,120C 'miss':106C 'no-fix':27B 'oper':125C 'packag':30B 'poc':32B 'poc-publ':31B 'product':124C 'public':33B,76B,118C 'reach':67B 'reachabl':9A 'releas':129C,145C 'remot':10A,64B,113C 'respond':157C 'result':104C 'roll':128C 'self':35B 'self-host':34B 'server':3A,19A,26B,40B,43B,87C 'skip':7A 'termin':47B 'track':22B 'updat':144C 'use':122C 'vehicl':46B 'vendor':147C 'version':138C 'vulner':80C 'way':160C 'web':4A,53B,99C 'webmvcconfig.addinterceptors':95C 'without':71B 'yezhihao':37B,84C","nicknames":[],"mitigations":[],"who_affected":"Teams running yezhihao jt808-server, a Java/Spring gateway for GPS vehicle terminals (JT/T 808), with its web management port reachable from untrusted networks. The advisory says the authentication interceptor is not applied, so anyone who can reach that port can call the management API without logging in; the README shows this API sends commands to terminals (for example POST /device/8103, set terminal parameters). Deployments with the web port bound to localhost or a private network, or behind their own authentication proxy, can mostly skip it; the device TCP/UDP port is a separate matter.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["jt808server"],"ptokens":["jt808","server"],"labels":["gpstracking","high","java","jt808server","nofix","package","pocpublic","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T17:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121926","severity":null,"published_at":"2026-11-04T17:17:35+00:00","modified_at":"2026-11-04T17:17:35+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","fetched_at":"2026-11-04T17:28:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121926:1687","url":null,"severity":null,"published_at":"2026-11-04T17:30:05+00:00","modified_at":"2026-11-04T17:30:05+00:00","first_seen_at":"2026-11-04T17:30:05+00:00","fetched_at":"2026-11-04T17:30:05+00:00","note":"VulDB (CNA) says the vendor never responded. GitHub shows no fix: the named commit a07f68c is a dependency bump from 2026-07-23, the repo's only open issue (#15) is unrelated, and no advisory exists. The exploit is a gist referenced only by VulDB (address not exposed). No primary vendor page, so nothing marked verified. Routes: only the README examples confirmed."}],"documents":[{"id":69000,"url":"https://vuldb.com/vuln/431035","title":"VDB-431035 jt808-server missing authentication","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":69001,"url":"https://github.com/yezhihao/jt808-server","title":"yezhihao/jt808-server README","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":69002,"url":"https://github.com/yezhihao/jt808-server/commit/a07f68c466b560b97ef41edb8a4966469abdf83e","title":"Commit a07f68c (dependency bump to 4.0.6, 2026-07-23)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}