CVE-2026-124436

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.32.2

Description An improper authorization issue allows realm administrators to access and modify global resources by calling admin endpoints that lack super administrator checks. An attacker can use the '/configuration/manager' endpoint to change the global keycloakUrl variable, enabling the redirection of console authentication for other realms to facilitate credential phishing. Additionally, this allows for CSS injection, replacement of map tiles, and deletion of logs.

Recommendations Update to version 1.32.2 or later. Restrict access to the '/configuration/manager' endpoint to prevent unauthorized modifications to global settings.