OpsTree REMS through version 1.0.0 lets an unauthenticated attacker get a valid admin JWT just by setting a client-controlled is_local_auth flag during login.
What Is It
CVE-2026-126768 is an authentication bypass in OpsTree Solutions' REMS, classified as CWE-287 (Improper Authentication). The login endpoint trusts a field supplied by the client, is_local_auth. An attacker sends a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth set to true. The server then returns a valid JWT with SuperUser administrative access.
VulnCheck disclosed the issue, and NVD published it on November 11, 2026. The NVD record is still in "Received" status.
Why It Matters
VulnCheck rates this flaw CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Under CVSS 4.0 it scores 9.3 (Critical). Exploitation:
- works over the network
- is low complexity
- needs no privileges or user interaction
A successful attack gives full administrative control of the REMS instance, with high impact to confidentiality, integrity and availability. The exploit is a single crafted login request, and a public write-up is linked from the NVD references. As a result, it is likely to be easy to weaponize against REMS deployments that can be reached over the network.
The supplied data has no CISA KEV entry for this CVE. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: OpsTree Solutions
- Product: REMS
- Affected versions: all versions through 1.0.0 (version 0 up to and including 1.0.0)
The NVD record does not list any CPEs yet.
Patch Status
The supplied NVD and KEV data does not name a fixed version or patch. Because there is no KEV entry, CISA has not issued a required action or remediation deadline. REMS operators should:
- check the VulnCheck advisory and the vendor for updates
- treat any internet-exposed REMS instance at version 1.0.0 or earlier as critically exposed until a fix is confirmed