HIGH
OpenAEV-Platform
CVE published 2026-10-14
CVE-2026-71854
OpenAEV, an open-source platform for planning, scheduling, and conducting cyber adversary simulation campaigns and tests, has a vulnerability in its player lessons API. Prior to version 2.260622.0, the `/api/player/**` lessons endpoints can be accessed without authentication, and they rely on a client-supplied `userId` query parameter without verifying the caller's identity or membership in the exercise. [truncated]