CVE-2026-71214
NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.
| CWE | CWE-306 |
| Vendor | nasa-ammos |
| Product | plandev (sequencing-server) |
| Published | Aug 5, 2026 |
| Last Updated | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for nasa-ammos plandev (sequencing-server)
Be the first to know when new critical vulnerabilities affecting nasa-ammos plandev (sequencing-server) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
NASA-AMMOS / plandev (sequencing-server)
0
Credits
Sardor Shoakbarov