EUVD-2026-109469

OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose...

CVE-2026-116185

OpenRemote core versions before 1.31.0 are susceptible to an authorization bypass vulnerability (CWE-639) within the getGatewayActiveTunnelInfos function. This flaw allows authenticated users to access gateway tunnel information belonging to other realms. By providing their own realm alongside a ...