MajorCritical vulnerability

CVE-2026-124436 (CVSS 8.6)

NVD · officialPublished Nov 8, 2026Risk 37/100EPSS 0.4%

OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.

Technical details

CVSS

8.6

AV:NetworkAC:LowPR:LowUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source