CVE-2026-110097

Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login t...

CVE-2026-110097

Ikaros versions 1.2.0 through 1.2.5 are vulnerable to an authentication bypass (CWE-287) that allows attackers with a valid password to skip TOTP verification . By reusing a login temp token obtained from the jwt/apply endpoint, an attacker can present it as a bearer JWT , refresh it, or use HTTP...