---
id: "CVE-2026-126768"
page: "https://infrastack.ai/live/CVE-2026-126768"
kind: "vulnerability"
aliases: ["CVE-2026-126768"]
title: "OpsTree REMS: login bypass grants unauthenticated attackers administrator access"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "REMS", "fixed": [], "affected": "<= 1.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["admin-panel", "auth-bypass", "other", "rems", "self-hosted"]
not_affected_if: ["api-not-reachable", "not-running-rems"]
published_at: "2026-11-11T19:17:37+00:00"
first_seen_at: "2026-11-11T19:28:46+00:00"
updated_at: "2026-11-11T19:31:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126768", "first_seen_at": "2026-11-11T19:28:46+00:00"}, {"source": "analyst", "url": "https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46", "first_seen_at": "2026-11-11T19:31:02+00:00", "cites": ["https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46"]}]
exploit_sources: [{"type": "poc", "url": "https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46"}]
---

# OpsTree REMS: login bypass grants unauthenticated attackers administrator access

Link for people: https://infrastack.ai/live/CVE-2026-126768 (this .md is for agents)

OpsTree REMS through 1.0.0 trusts a client-controlled is_local_auth field at login, so the server issues valid JWTs without a correct password. An unauthenticated attacker can log in as the admin account and gain SuperUser administrative access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:REMS affected <= 1.0.0 fixed no fixed version listed

## How to check

Confirm the REMS version (1.0.0 or earlier is affected). Search proxy/access logs for POST /api/v1/user/login/ with is_local_auth true, especially for the admin user followed by a 200. Check for unexpected SuperUser sessions or account changes. Test your own instance: a login with a wrong password and is_local_auth true must be rejected.

## Fix

Vendor reportedly patched (per researcher's gist); fixed version not published. Ask OpsTree for the patched build; REMS 1.0.0 and earlier are affected.

## Timeline

- 2026-11-11T19:28:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126768
- 2026-11-11T19:31:02+00:00 analyst https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46 — VulnCheck + researcher gist (Kotnis). Gist says vendor patched it but gives no fixed version; no vendor advisory found. Siblings: CVE-2026-126769, -126771. PoC public in gist; no exploitation reported.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-authentication-bypass-via-is-local-auth-flag
- [poc] REMS authentication bypass advisory (researcher gist) https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46

## From the sources

OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_