CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose `aas` or `path` query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924.

• CWE-201

• https://github.com/eclipse-basyx/basyx-aas-web-ui/pull/1557
• https://github.com/eclipse-basyx/basyx-aas-web-ui/releases/tag/v2-260924
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/328

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-101308When an audio channel's buffer needs to be resized, the soun…5.5
• CVE-2026-101309The xHCI (USB 3) device model did not validate or save the e…7
• CVE-2026-10131An OS command injection vulnerability exists in the boa form…9.1
• CVE-2026-101310The HDA audio device model did not check for zero-length Buf…7
• CVE-2026-101311The framebuffer device model's maximum resolution constants …7
• CVE-2026-10132A stack-based buffer overflow vulnerability exists in the bo…9.1
• CVE-2026-101324The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…4.7
• CVE-2026-101329IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote a…6.5
• CVE-2026-10133A stack-based buffer overflow vulnerability exists in the ba…9.1
• CVE-2026-101331IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote a…6.5
• CVE-2026-101333A flaw was found in the Micrometer user-event metrics listen…3.7
• CVE-2026-101335The Forminator Forms – Contact Form, Payment Form & Custom F…6.5