CVE-2026-105034
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication.
Published Oct 15, 2026 · updated Oct 15, 2026
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
Sources
- CVE.orgVulnerability recordCVE-2026-105034
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-105034
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
nvd.nist.gov