CVE-2026-94455

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An HTTP endpoint used for provisioning enterprise and reseller organisations is accessible without a session because the authentication middleware does not include the enterprise controller in its list of protected controllers. The endpoint only verifies that the request body contains a token signed with the instance secret but fails to validate the token's purpose, audience, or expiry. Consequently, a standard user session token can be used to bypass authentication. Successful exploitation allows an attacker to create a new organisation with the highest subscription tier, a lifetime flag, and an excessive channel allowance, while also creating an organisation-owner account and obtaining a valid API key for the public API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.