---
id: "CVE-2026-121926"
kind: "vulnerability"
aliases: ["CVE-2026-121926"]
title: "jt808-server: Web Management API skips authentication, reachable remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "jt808-server", "fixed": [], "affected": "master up to and including a07f68c466b560b97ef41edb8a4966469abdf83e (rolling release, no versions)", "ecosystem": "github"}]
ecosystems: []
tags: ["gps-tracking", "java", "jt808-server", "no-fix", "package", "poc-public", "self-hosted"]
not_affected_if: ["auth-proxy-in-front", "management-api-not-exposed"]
published_at: "2026-11-04T17:17:35+00:00"
first_seen_at: "2026-11-04T17:28:12+00:00"
updated_at: "2026-11-04T17:30:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121926", "first_seen_at": "2026-11-04T17:28:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T17:30:05+00:00"}]
---

# jt808-server: Web Management API skips authentication, reachable remotely

yezhihao jt808-server, a Java server for GPS vehicle terminals, has a flaw in its web management interface where the authentication interceptor is not applied. A remote attacker can reach the management API without logging in, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:jt808-server affected master up to and including a07f68c466b560b97ef41edb8a4966469abdf83e (rolling release, no versions) fixed ?

## How to check

- Check whether you run yezhihao/jt808-server (GitHub/Gitee) and which commit it was built from (git rev-parse HEAD). VulDB names a07f68c466b560b97ef41edb8a4966469abdf83e (2026-07-23, a dependency bump to 4.0.6) as the last affected commit; the project has no release versions.
- From a machine that is not trusted, request the management API without credentials, for example the OpenAPI/Swagger pages (/doc.html, /swagger-ui/index.html) or the device command routes such as POST /device/8103 on the web port (the README shows 8100 or 8000). Any answer other than 401/403 means the API is open.
- Read WebMvcConfig.addInterceptors in your build and confirm an authentication interceptor covers all routes. The public exploit is a gist linked from VulDB; I could not retrieve its address, so the exact route is unconfirmed.

## Timeline

- 2026-11-04T17:28:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121926
- 2026-11-04T17:30:05+00:00 analyst — VulDB (CNA) says the vendor never responded. GitHub shows no fix: the named commit a07f68c is a dependency bump from 2026-07-23, the repo's only open issue (#15) is unrelated, and no advisory exists. The exploit is a gist referenced only by VulDB (address not exposed). No primary vendor page, so nothing marked verified. Routes: only the README examples confirmed.

## Documents

- [advisory] VDB-431035 jt808-server missing authentication https://vuldb.com/vuln/431035
- [describes] yezhihao/jt808-server README https://github.com/yezhihao/jt808-server
- [mentions] Commit a07f68c (dependency bump to 4.0.6, 2026-07-23) https://github.com/yezhihao/jt808-server/commit/a07f68c466b560b97ef41edb8a4966469abdf83e

## From the sources

A vulnerability was detected in yezhihao jt808-server up to a07f68c466b560b97ef41edb8a4966469abdf83e. Affected is the function WebMvcConfig.addInterceptors of the component Web Management API. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_