CVE-2026-42084

The record

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.

Affected packages

Related vulnerabilities

• GHSA-wgx6-g857-jjf7 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence Same vulnerability
• CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. CWE-620
• CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user… CWE-620
• CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. CWE-620
• CVE-2026-54801 A vulnerability has been identified in CPCI85 Central Processing/Communication (All… CWE-620
• CVE-2026-44733 OpenProject is open-source, web-based project management software. CWE-620
• CVE-2025-71328 Flowise before 3.0.10 contains an unverified password change vulnerability. CWE-620
• CVE-2025-71337 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email… CWE-620