CVE-2026-49447

The record

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.

Affected packages

Related vulnerabilities

• CVE-2026-121531 A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. CWE-287
• CVE-2026-120574 The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in… CWE-287
• CVE-2026-120538 The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass… CWE-287
• CVE-2026-58915 A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD)… CWE-287
• CVE-2026-120447 HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows… CWE-287
• CVE-2026-120278 A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. CWE-287
• CVE-2026-120263 When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and… CWE-287
• CVE-2026-120191 A weakness has been identified in Presenton up to 0.9.11-beta. CWE-287