{"id":"CVE-2026-126768","kind":"vulnerability","aliases":["CVE-2026-126768"],"related":[],"title":"OpsTree REMS: login bypass grants unauthenticated attackers administrator access","description":"OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.","summary":"OpsTree REMS through 1.0.0 trusts a client-controlled is_local_auth field at login, so the server issues valid JWTs without a correct password. An unauthenticated attacker can log in as the admin account and gain SuperUser administrative access.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"REMS","fixed":[],"affected":"<= 1.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["admin-panel","auth-bypass","other","rems","self-hosted"],"not_affected_if":["api-not-reachable","not-running-rems"],"how_to_check":"Confirm the REMS version (1.0.0 or earlier is affected). Search proxy/access logs for POST /api/v1/user/login/ with is_local_auth true, especially for the admin user followed by a 200. Check for unexpected SuperUser sessions or account changes. Test your own instance: a login with a wrong password and is_local_auth true must be rejected.","fix":"Vendor reportedly patched (per researcher's gist); fixed version not published. Ask OpsTree for the patched build; REMS 1.0.0 and earlier are affected.","status":"open","published_at":"2026-11-11T19:17:37+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","triaged_at":"2026-11-11T19:29:42+00:00","updated_at":"2026-11-11T19:31:02+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T19:29:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpsTree REMS: login bypass grants unauthenticated attackers administrator access","impact":"high","summary":"OpsTree REMS through 1.0.0 trusts a client-controlled is_local_auth field at login, so the server issues valid JWTs without a correct password. An unauthenticated attacker can log in as the admin account and gain SuperUser administrative access.","audience":"businesses","category":"other","nicknames":[],"who_cares":["rems","self-hosted","admin-panel"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker gains full SuperUser administrative access to the application","analyst_note":"Find the vendor advisory or the fixed version for OpsTree REMS; check the VulnCheck advisory linked in the sources for affected version ranges and remediation.","how_to_check":"- Check whether the deployed REMS version is `1.0.0` or earlier, using the version in the project's release or package metadata.\n- Look for the login endpoint `POST /api/v1/user/login/` in reverse proxy or access logs with requests carrying `is_local_auth` set to true.\n- unknown for any further check; the sources do not name a configuration or file to inspect.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-running-rems","api-not-reachable"],"who_is_affected":"Any deployment of OpsTree REMS through 1.0.0 that exposes the login API is exposed, since the login path accepts the client-supplied is_local_auth flag. Teams that do not run REMS, or that keep its API behind a network boundary the attacker cannot reach, are less exposed. The sources do not state whether a patched release exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00078,"input_tokens":4603,"output_tokens":639,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or the fixed version for OpsTree REMS; check the VulnCheck advisory linked in the sources for affected version ranges and remediation.","search":"'-126768':12A,15A '-2026':11A,14A '/api/v1/user/login':100C '1.0.0':31B,71C 'access':9A,67B,119C 'account':62B,105C 'admin':18B,61B,104C 'admin-panel':17B 'administr':8A,66B,118C 'allow':78C 'attack':7A,55B,80C,95C 'auth':21B,39B,93C,113C 'auth-bypass':20B 'authent':74C 'bypass':4A,22B,75C 'client':35B,89C 'client-control':34B,88C 'contain':72C 'control':36B,90C 'correct':51B 'cve':10A,13A 'field':40B,94C 'gain':64B,116C 'grant':5A 'host':27B 'invalid':108C 'issu':46B 'jwts':48B,84C 'local':38B,92C,112C 'log':57B 'login':3A,42B 'obtain':82C 'opstre':1A,28B,68C 'panel':19B 'password':52B,109C 'post':99C 'rem':2A,24B,29B,69C 'rems':16A 'request':101C 'self':26B 'self-host':25B 'send':97C 'server':45B 'set':86C 'superus':65B,117C 'true':114C 'trust':32B 'unauthent':6A,54B,79C 'valid':47B,83C 'vulner':76C 'without':49B","nicknames":[],"mitigations":[],"who_affected":"Anyone running OpsTree REMS (the AI observability platform) on-premises at version 1.0.0 or earlier with the web/API reachable. The server trusts a client-supplied is_local_auth flag, so an unauthenticated attacker can get an admin JWT. Teams not running REMS, or with it reachable only on a locked-down internal network, are much less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["rems"],"ptokens":["rems"],"labels":["adminpanel","authbypass","critical","other","rems","selfhosted"],"campaign_type":null,"search_a":"'-126768':12A,15A '-2026':11A,14A 'access':9A 'administr':8A 'attack':7A 'bypass':4A 'cve':10A,13A 'grant':5A 'login':3A 'opstre':1A 'rem':2A 'rems':16A 'unauthent':6A","search_b":"'1.0.0':31B 'access':67B 'account':62B 'admin':18B,61B 'admin-panel':17B 'administr':66B 'attack':55B 'auth':21B,39B 'auth-bypass':20B 'bypass':22B 'client':35B 'client-control':34B 'control':36B 'correct':51B 'field':40B 'gain':64B 'host':27B 'issu':46B 'jwts':48B 'local':38B 'log':57B 'login':42B 'opstre':28B 'panel':19B 'password':52B 'rem':24B,29B 'self':26B 'self-host':25B 'server':45B 'superus':65B 'trust':32B 'unauthent':54B 'valid':47B 'without':49B","search_c":"'/api/v1/user/login':100C '1.0.0':71C 'access':119C 'account':105C 'admin':104C 'administr':118C 'allow':78C 'attack':80C,95C 'auth':93C,113C 'authent':74C 'bypass':75C 'client':89C 'client-control':88C 'contain':72C 'control':90C 'field':94C 'gain':116C 'invalid':108C 'jwts':84C 'local':92C,112C 'obtain':82C 'opstre':68C 'password':109C 'post':99C 'rem':69C 'request':101C 'send':97C 'set':86C 'superus':117C 'true':114C 'unauthent':79C 'valid':83C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-126768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126768","severity":null,"published_at":"2026-11-11T19:17:37+00:00","modified_at":"2026-11-11T19:17:37+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","fetched_at":"2026-11-11T19:28:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126768:3579","url":"https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46","severity":null,"published_at":"2026-11-11T19:31:02+00:00","modified_at":"2026-11-11T19:31:02+00:00","first_seen_at":"2026-11-11T19:31:02+00:00","fetched_at":"2026-11-11T19:31:02+00:00","note":"VulnCheck + researcher gist (Kotnis). Gist says vendor patched it but gives no fixed version; no vendor advisory found. Siblings: CVE-2026-126769, -126771. PoC public in gist; no exploitation reported.","cites":["https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46"]}],"documents":[{"id":128098,"url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-authentication-bypass-via-is-local-auth-flag","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":128312,"url":"https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46","title":"REMS authentication bypass advisory (researcher gist)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}