CVE-2026-71854 OpenAEV has unauthenticated access and missing object-level authorization on player lessons API

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/ lessons endpoints can be called without authentication, and they trust a client-supplied...

CVE-2026-71854

The OpenAEV platform (prior to version 2.260622.0 ) contains a vulnerability where the /api/player/** lessons endpoints lack proper authentication and object-level authorization on default installations. The application fails to verify the caller's identity, instead trusting a client-supplied use...