CVE-2026-85432
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.29%
- CWE
- CWE-290
- Published
- 2026-09-03
- Last modified
- 2026-09-04
Affected products
- themoos core-moos
Weakness type
Related vulnerabilities
- CVE-2026-63427 — An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a...
- CVE-2026-88011 — Traefik: ForwardAuth identity spoofing via dot-form header alias
- CVE-2026-66674 — WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability
- CVE-2026-88879 — Traefik before v2.11.56 Identity Spoofing via Header Alias
- CVE-2026-82563 — Softish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofing
- CVE-2026-82530 — IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header
- CVE-2026-62759 — Windows Netlogon Spoofing Vulnerability
- CVE-2026-86478 — In JetBrains YouTrack before 2025.3.161254,...