{"id":"CVE-2026-18451","kind":"vulnerability","aliases":["CVE-2026-18451"],"related":[],"title":"KVM-over-IP HTML5 console: weak session token lets attacker take over session","description":"The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.","summary":"The HTML5 KVM-over-IP console authenticates using a token returned by the device's web interface. Weaknesses in how that token is generated may let an attacker guess a session token and take control of the KVM session.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appliance","bmc","infrastructure","kvm-over-ip"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","triaged_at":"2026-10-27T08:32:37+00:00","updated_at":"2026-10-27T08:32:37+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-27T08:32:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"KVM-over-IP HTML5 console: weak session token lets attacker take over session","impact":"high","summary":"The HTML5 KVM-over-IP console authenticates using a token returned by the device's web interface. Weaknesses in how that token is generated may let an attacker guess a session token and take control of the KVM session.","category":"infrastructure","nicknames":[],"who_cares":["kvm-over-ip","bmc","appliance"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker takes over a KVM console session on the device","analyst_note":"Sources give no vendor, product, affected versions or fix; check the NVD entry and vendor advisory for the affected KVM product and patched firmware.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.0005,"input_tokens":3271,"output_tokens":346,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-18451':17A,20A '-2026':16A,19A 'allow':89C 'applianc':21B 'attack':11A,56B,91C 'authent':35B,75C 'bmc':22B 'consol':6A,34B,74C 'control':63B,99C 'cve':15A,18A 'devic':42B 'generat':52B,87C 'guess':57B,93C 'html5':5A,29B,69C 'infrastructur':23B 'interfac':45B,83C 'ip':4A,27B,33B,73C 'kvm':2A,25B,31B,66B,71C,102C 'kvm-over-ip':1A,24B,30B,70C 'let':10A,54B 'may':53B,88C 'return':39B,79C 'session':8A,14A,59B,67B,95C,103C 'take':12A,62B,98C 'token':9A,38B,50B,60B,78C,86C,96C 'use':36B 'weak':7A,46B,84C 'web':44B,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"def9a96e-e099-41a9-bfac-30fd4f82c411","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18451","severity":null,"published_at":"2026-10-27T08:16:53+00:00","modified_at":"2026-10-27T08:16:53+00:00","first_seen_at":"2026-10-27T08:31:47+00:00","fetched_at":"2026-10-27T08:31:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}