[ CVE-2026-89309 · Published 13 Oct 2026 ]
Vulnerability in JTL SW GmbH JTL-WMS
[ Why it matters ]Priority signals
- Critical severity: CVSS 10.0
[ Description ]Official description
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.