CVE-2026-42084 - Vulnerability Analysis

Overview

OpenC3 COSMOS < 6.10.5 and < 7.0.0-rc3 contains a broken authentication caused by password change functionality accepting valid session token without old password, letting attackers with valid tokens hijack accounts, exploit requires valid session token.

Severity & Score

Impact

Attackers with valid session tokens can hijack accounts, including admin, causing persistent unauthorized access and denial of service to legitimate users.

Mitigation

Update to versions 6.10.5 or 7.0.0-rc3 or later.

References

• https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776
• https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
• https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner