CVE-2026-105040

The EnergizeLab Eilik NestJS auth service is vulnerable to a mass assignment flaw. The service accepts a user-controlled user ID during account update requests, allowing a registered user to modify another account's identifier. This vulnerability results in an account takeover , as an attacker ca...

CVE-2026-105034

The EnergizeLab Eilik NestJS auth service is vulnerable to unauthenticated device-token issuance. Due to missing and improper authentication (CWE-306, CWE-287), a remote attacker can obtain a valid device token for any arbitrary robot serial number. This allows the attacker to impersonate any dev...