CVE-2026-126065

OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose passwordext value is missing or empty. SSO-provisioned and migration-creat...

PT-2026-144664

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 1.1.0 Description A flaw in the shared authentication validator located in src/api/common/src/auth/validator.rs allows an unauthenticated attacker to bypass authentication for accounts where the password ext value...