CVE-2026-71854

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/ lessons endpoints can be called without authentication, and they trust a client-supplied...

CVE-2026-71854: Missing Authentication for Critical Function

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/ lessons endpoints can be called without authentication, and they trust a client-supplied...

OpenAEV Platform: OpenAEV Authorization Issues Vulnerability

The OpenAEV Platform versions prior to 2.260622.0 have an authorization issue vulnerability. This vulnerability stems from the /api/player/ lessons endpoint, which can be called without authentication, and the userId parameter provided by the client is not verified. This allows unauthorized...