Key points
- OpenAEV versions prior to 2.260622.0 contain an authentication bypass vulnerability rated CVSS 8.2.
- Attackers can read and overwrite lessons-learned answers without logging into the platform.
- The vendor has released version 2.260622.0 which patches the insecure API endpoints.
OpenAEV, an open source platform for cyber adversary simulation, has released a security update addressing a high-severity authentication flaw. The vulnerability affects all versions of the OpenAEV-Platform prior to 2.260622.0. According to the National Vulnerability Database record for CVE-2026-71854, the issue allows unauthenticated access to sensitive exercise data on default installations.
In plain English
The flaw exists in the `/api/player/**` endpoints used for managing lessons learned during simulation campaigns. On a default installation, these endpoints do not require the caller to log in. The system trusts a `userId` query parameter supplied by the client without verifying that the caller is actually that user or a member of the specific exercise. This means anyone who knows an exercise UUID can interact with the data.
The background
An unauthenticated client with knowledge of an exercise UUID can read lessons-learned questions and answers. This includes viewing the identity of the author for each answer. The attacker can also create new answers or overwrite existing ones, attributing them to any arbitrary user within the system. The weaknesses are classified as CWE-306, CWE-639, and CWE-862.
What changes now
Version 2.260622.0 contains a patch that resolves this authentication bypass. Organizations using earlier versions must upgrade to this release to secure their simulation data. The update ensures that the API endpoints properly verify user identity and membership before allowing access to or modification of exercise content.
Who needs to act first
Security teams should prioritize updating systems that host active or recent adversary simulation campaigns. Check whether your deployment uses default configurations that expose these API endpoints to the internet or internal networks. Roll out the update to exposed systems first, then test the fix in a staging environment to ensure compatibility with existing exercises. Back up current exercise data before applying the patch to prevent data loss during the upgrade process.
Background: Authentication bypass vulnerabilities
Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.
Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
What to do and how to stay safe: OpenAEV
- Verify your current OpenAEV-Platform version and compare it against the patched 2.260622.0 release.
- Review access logs for the `/api/player/` endpoints to detect potential unauthorized access attempts.
- Restrict network access to OpenAEV management interfaces to trusted internal networks only.
- Monitor exercise data for unexpected changes or new entries attributed to unknown users.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-71854?
The vulnerability has a CVSS score of 8.2, which is rated as high severity.
Can an attacker modify data without logging in?
Yes, an unauthenticated client can create or overwrite answers attributed to an arbitrary user.
Is there a fix available for this vulnerability?
Yes, version 2.260622.0 of OpenAEV-Platform contains a patch for this issue.
