CVE-2026-48117

Name of the Vulnerable Software and Affected Versions DroneAware server (affected versions not specified)

Description The centralized server backing droneaware.io was subject to an account pre-hijacking attack. An attacker could register an account using a victim's email address and a password controlled by the attacker before the victim activated the account. If the legitimate owner subsequently activated the account via a verification link or Google SSO, the attacker's password became valid, allowing for a silent and persistent account takeover without notifying the victim.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.