CVE-2026-42084

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42084
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42084.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42084
Aliases
Published
2026-05-04T17:11:31.853Z
Modified
2026-07-15T01:49:18.981418417Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence
Details

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-620"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42084.json"
}
References

Affected packages

Git / github.com/openc3/cosmos

Affected ranges

Type
GIT
Repo
https://github.com/openc3/cosmos
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
13ea2c8deb37ac3f306fee264e725602e5a6cf1a
Introduced
132648bad3b202bc5acf4d099d0af2341ec97047
Fixed
2e623714e3426d5ae81b6f8239d4a2a6937ef776
Fixed
c3ea3499cc01801122361524f6ccce2fdfbc35f0
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:*",
        "cpe:2.3:a:openc3:cosmos:7.0.0:rc1:*:*:open_source:*:*:*",
        "cpe:2.3:a:openc3:cosmos:7.0.0:rc2:*:*:open_source:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.10.5"
        },
        {
            "introduced": "7.0.0-rc1"
        },
        {
            "last_affected": "7.0.0-rc1"
        },
        {
            "introduced": "7.0.0-rc2"
        },
        {
            "last_affected": "7.0.0-rc2"
        }
    ]
}

Affected versions

7.*
7.0.0-rc1
7.0.0-rc2
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.1.2
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.5.1
v3.6.0
v3.6.1
v3.6.2
v3.7.0
v3.8.0
v3.8.1
v3.8.2
v3.8.3
v3.9.0
v3.9.1
v3.9.2
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.2.3
v4.3.0
v5.*
v5.0.0
v5.0.0-beta.1
v5.0.0.beta2
v5.0.1
v5.0.10
v5.0.11
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.7
v5.0.8
v5.0.9
v5.1.0
v5.1.1
v5.10.0
v5.10.1
v5.11.0
v5.11.1
v5.11.2
v5.11.3
v5.12.0
v5.13.0
v5.14.0
v5.14.1
v5.14.2
v5.15.0
v5.15.1
v5.15.2
v5.16.0
v5.16.1
v5.16.2
v5.17.0
v5.17.1
v5.18.0
v5.19.0
v5.2.0
v5.20.0
v5.3.0
v5.4.0
v5.4.1
v5.4.2
v5.4.3-beta0
v5.5.0
v5.5.0-beta0
v5.5.1
v5.5.2
v5.5.2-beta0
v5.6.0
v5.6.1
v5.7.0
v5.7.2
v5.8.0
v5.8.1
v5.9.0
v5.9.1
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.1.0
v6.10.0
v6.10.1
v6.10.2
v6.10.3
v6.10.4
v6.2.0
v6.2.1
v6.3.0
v6.4.0
v6.4.1
v6.4.2
v6.5.0
v6.5.1
v6.6.0
v6.7.0
v6.8.1
v6.9.0
v6.9.1
v6.9.2
v7.*
v7.0.0-rc1
v7.0.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42084.json"