high severity · published 2026-11-10
An unauthenticated attacker with network access can compute a valid token because the decryption key and IV are hardcoded and identical on all VOS appliances. Submitting it to the decryptTest endpoint, which sits before the session authentication middleware, grants them a fully authenticated session on the VOS appliance.
CVE: CVE-2026-107244
Source: NVD
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2284 and your operating system.