CVE-2026-49447
Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.
| CWE | CWE-287 |
| Vendor | azukaar |
| Product | cosmos-server |
| Published | Jul 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for azukaar cosmos-server
Be the first to know when new medium vulnerabilities affecting azukaar cosmos-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
azukaar / Cosmos-Server
0.22.18