CVE-2026-103057
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-306
Ausencia de autenticación para una función crítica
Fecha de publicación:
30/09/2026
Última modificación:
30/09/2026
Descripción
*** Pendiente de traducción *** AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.
Impacto
Puntuación base 4.0
5.30
Gravedad 4.0
MEDIA
Puntuación base 3.x
4.30
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/index.ts#L681-L691
- https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43
- https://github.com/beenuar/AiSOC/releases/tag/v12.0.0
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37
- https://www.vulncheck.com/advisories/aisoc-5.1.0-before-12.0.0-missing-authentication-on-realtime-service-internal-endpoints
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37