CVE-2026-42084 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid...

CVE-2026-42084

creationtimestamp| type| source ---|---|--- 2026-04-20 03:08:12+00:00| published-proof-of-concept| https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7 2026-05-04 18:19:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2bwqjgot2c 2026-05-04...