Read the docs
TI-2023-26756 Aliases CVE-2023-49091

Jwttoken in Cosmos server never expires after password changed and logging out

Priority HIGH 76CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-613.

Summary

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an attacker to use the token to gain unauthorized access to the application/system even after the user has logged out. This issue has been patched in version 0.13.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0077 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Cosmos-Server (azukaar): 0.13.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
azukaarCosmos-Serverbefore 0.13.10.13.1Patch availableCNA
  • Cosmos-Server Vendorazukaar Affected before 0.13.1 Fixed in 0.13.1 Patch available CNA

CPE configurations NVD · 91

CPEVersionsRoleVendor
cpe:2.3:a:cosmos-cloud:cosmos_server:0.1.15:*:*:*:*:*:*:*0.1.15VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.1.16:*:*:*:*:*:*:*0.1.16VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.1.17:*:*:*:*:*:*:*0.1.17VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.2.0:*:*:*:*:*:*:*0.2.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.0:-:*:*:*:*:*:*0.3.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.1:*:*:*:*:*:*:*0.3.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.2:*:*:*:*:*:*:*0.3.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.3:*:*:*:*:*:*:*0.3.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.4:*:*:*:*:*:*:*0.3.4VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.5:*:*:*:*:*:*:*0.3.5VulnerableCosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.1.15:*:*:*:*:*:*:* Versions 0.1.15 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.1.16:*:*:*:*:*:*:* Versions 0.1.16 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.1.17:*:*:*:*:*:*:* Versions 0.1.17 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.0:-:*:*:*:*:*:* Versions 0.3.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.1:*:*:*:*:*:*:* Versions 0.3.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.2:*:*:*:*:*:*:* Versions 0.3.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.3:*:*:*:*:*:*:* Versions 0.3.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.4:*:*:*:*:*:*:* Versions 0.3.4 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.5:*:*:*:*:*:*:* Versions 0.3.5 Vulnerable ·Cosmos-cloud
Show 81 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cosmos-cloud:cosmos_server:0.4.0:-:*:*:*:*:*:*0.4.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.4.1:*:*:*:*:*:*:*0.4.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.4.2:*:*:*:*:*:*:*0.4.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.4.3:*:*:*:*:*:*:*0.4.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.0:-:*:*:*:*:*:*0.5.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.1:*:*:*:*:*:*:*0.5.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.2:*:*:*:*:*:*:*0.5.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.3:*:*:*:*:*:*:*0.5.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.4:*:*:*:*:*:*:*0.5.4VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.5:*:*:*:*:*:*:*0.5.5VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.6:*:*:*:*:*:*:*0.5.6VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.7:-:*:*:*:*:*:*0.5.7VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.8:*:*:*:*:*:*:*0.5.8VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.9:*:*:*:*:*:*:*0.5.9VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.12:*:*:*:*:*:*:*0.5.12VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.0:-:*:*:*:*:*:*0.6.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.1:*:*:*:*:*:*:*0.6.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.2:*:*:*:*:*:*:*0.6.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.3:*:*:*:*:*:*:*0.6.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.4:-:*:*:*:*:*:*0.6.4VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.0:-:*:*:*:*:*:*0.7.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.1:*:*:*:*:*:*:*0.7.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.2:*:*:*:*:*:*:*0.7.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.3:*:*:*:*:*:*:*0.7.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.4:*:*:*:*:*:*:*0.7.4VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.5:*:*:*:*:*:*:*0.7.5VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.6:*:*:*:*:*:*:*0.7.6VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.7:*:*:*:*:*:*:*0.7.7VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.8:*:*:*:*:*:*:*0.7.8VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.9:*:*:*:*:*:*:*0.7.9VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.10:*:*:*:*:*:*:*0.7.10VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.0:-:*:*:*:*:*:*0.8.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.1:*:*:*:*:*:*:*0.8.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.2:*:*:*:*:*:*:*0.8.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.3:*:*:*:*:*:*:*0.8.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.4:*:*:*:*:*:*:*0.8.4VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.5:*:*:*:*:*:*:*0.8.5VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.6:*:*:*:*:*:*:*0.8.6VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.7:*:*:*:*:*:*:*0.8.7VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.8:*:*:*:*:*:*:*0.8.8VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.9:*:*:*:*:*:*:*0.8.9VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.10:*:*:*:*:*:*:*0.8.10VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.11:*:*:*:*:*:*:*0.8.11VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.0:-:*:*:*:*:*:*0.9.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.1:*:*:*:*:*:*:*0.9.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.2:*:*:*:*:*:*:*0.9.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.3:*:*:*:*:*:*:*0.9.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.4:*:*:*:*:*:*:*0.9.4VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.5:*:*:*:*:*:*:*0.9.5VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.6:*:*:*:*:*:*:*0.9.6VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.7:*:*:*:*:*:*:*0.9.7VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.8:*:*:*:*:*:*:*0.9.8VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.9:*:*:*:*:*:*:*0.9.9VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.10:*:*:*:*:*:*:*0.9.10VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.11:*:*:*:*:*:*:*0.9.11VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.12:*:*:*:*:*:*:*0.9.12VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.13:*:*:*:*:*:*:*0.9.13VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.14:*:*:*:*:*:*:*0.9.14VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.15:*:*:*:*:*:*:*0.9.15VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.16:*:*:*:*:*:*:*0.9.16VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.17:*:*:*:*:*:*:*0.9.17VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.18:*:*:*:*:*:*:*0.9.18VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.19:-:*:*:*:*:*:*0.9.19VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.20:*:*:*:*:*:*:*0.9.20VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.21:*:*:*:*:*:*:*0.9.21VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.0:-:*:*:*:*:*:*0.10.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.1:-:*:*:*:*:*:*0.10.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.2:*:*:*:*:*:*:*0.10.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.3:*:*:*:*:*:*:*0.10.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.4:-:*:*:*:*:*:*0.10.4VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.11.0:-:*:*:*:*:*:*0.11.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.11.1:*:*:*:*:*:*:*0.11.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.11.2:*:*:*:*:*:*:*0.11.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.11.3:*:*:*:*:*:*:*0.11.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.0:-:*:*:*:*:*:*0.12.0VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.1:*:*:*:*:*:*:*0.12.1VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.2:*:*:*:*:*:*:*0.12.2VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.3:*:*:*:*:*:*:*0.12.3VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.4:*:*:*:*:*:*:*0.12.4VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.5:*:*:*:*:*:*:*0.12.5VulnerableCosmos-cloud
cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.6:-:*:*:*:*:*:*0.12.6VulnerableCosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.4.0:-:*:*:*:*:*:* Versions 0.4.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.4.1:*:*:*:*:*:*:* Versions 0.4.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.4.2:*:*:*:*:*:*:* Versions 0.4.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.4.3:*:*:*:*:*:*:* Versions 0.4.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.0:-:*:*:*:*:*:* Versions 0.5.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.1:*:*:*:*:*:*:* Versions 0.5.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.2:*:*:*:*:*:*:* Versions 0.5.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.3:*:*:*:*:*:*:* Versions 0.5.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.4:*:*:*:*:*:*:* Versions 0.5.4 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.5:*:*:*:*:*:*:* Versions 0.5.5 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.6:*:*:*:*:*:*:* Versions 0.5.6 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.7:-:*:*:*:*:*:* Versions 0.5.7 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.8:*:*:*:*:*:*:* Versions 0.5.8 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.9:*:*:*:*:*:*:* Versions 0.5.9 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.5.12:*:*:*:*:*:*:* Versions 0.5.12 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.0:-:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.1:*:*:*:*:*:*:* Versions 0.6.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.2:*:*:*:*:*:*:* Versions 0.6.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.3:*:*:*:*:*:*:* Versions 0.6.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.6.4:-:*:*:*:*:*:* Versions 0.6.4 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.0:-:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.2:*:*:*:*:*:*:* Versions 0.7.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.3:*:*:*:*:*:*:* Versions 0.7.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.4:*:*:*:*:*:*:* Versions 0.7.4 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.5:*:*:*:*:*:*:* Versions 0.7.5 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.6:*:*:*:*:*:*:* Versions 0.7.6 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.7:*:*:*:*:*:*:* Versions 0.7.7 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.8:*:*:*:*:*:*:* Versions 0.7.8 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.9:*:*:*:*:*:*:* Versions 0.7.9 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.7.10:*:*:*:*:*:*:* Versions 0.7.10 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.0:-:*:*:*:*:*:* Versions 0.8.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.2:*:*:*:*:*:*:* Versions 0.8.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.3:*:*:*:*:*:*:* Versions 0.8.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.4:*:*:*:*:*:*:* Versions 0.8.4 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.5:*:*:*:*:*:*:* Versions 0.8.5 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.6:*:*:*:*:*:*:* Versions 0.8.6 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.7:*:*:*:*:*:*:* Versions 0.8.7 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.8:*:*:*:*:*:*:* Versions 0.8.8 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.9:*:*:*:*:*:*:* Versions 0.8.9 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.10:*:*:*:*:*:*:* Versions 0.8.10 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.8.11:*:*:*:*:*:*:* Versions 0.8.11 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.0:-:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.5:*:*:*:*:*:*:* Versions 0.9.5 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.6:*:*:*:*:*:*:* Versions 0.9.6 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.7:*:*:*:*:*:*:* Versions 0.9.7 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.9:*:*:*:*:*:*:* Versions 0.9.9 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.10:*:*:*:*:*:*:* Versions 0.9.10 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.11:*:*:*:*:*:*:* Versions 0.9.11 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.12:*:*:*:*:*:*:* Versions 0.9.12 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.13:*:*:*:*:*:*:* Versions 0.9.13 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.14:*:*:*:*:*:*:* Versions 0.9.14 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.15:*:*:*:*:*:*:* Versions 0.9.15 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.16:*:*:*:*:*:*:* Versions 0.9.16 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.17:*:*:*:*:*:*:* Versions 0.9.17 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.18:*:*:*:*:*:*:* Versions 0.9.18 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.19:-:*:*:*:*:*:* Versions 0.9.19 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.20:*:*:*:*:*:*:* Versions 0.9.20 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.9.21:*:*:*:*:*:*:* Versions 0.9.21 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.0:-:*:*:*:*:*:* Versions 0.10.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.1:-:*:*:*:*:*:* Versions 0.10.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.2:*:*:*:*:*:*:* Versions 0.10.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.3:*:*:*:*:*:*:* Versions 0.10.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.10.4:-:*:*:*:*:*:* Versions 0.10.4 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.11.0:-:*:*:*:*:*:* Versions 0.11.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.11.1:*:*:*:*:*:*:* Versions 0.11.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.11.2:*:*:*:*:*:*:* Versions 0.11.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.11.3:*:*:*:*:*:*:* Versions 0.11.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.0:-:*:*:*:*:*:* Versions 0.12.0 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.1:*:*:*:*:*:*:* Versions 0.12.1 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.2:*:*:*:*:*:*:* Versions 0.12.2 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.3:*:*:*:*:*:*:* Versions 0.12.3 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.4:*:*:*:*:*:*:* Versions 0.12.4 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.5:*:*:*:*:*:*:* Versions 0.12.5 Vulnerable ·Cosmos-cloud
  • cpe:2.3:a:cosmos-cloud:cosmos_server:0.12.6:-:*:*:*:*:*:* Versions 0.12.6 Vulnerable ·Cosmos-cloud

Remediation

  • Fix · CNA Cosmos-Server (azukaar) Fixed in 0.13.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49091

References

Exploit 1

Patch 1

  • TI-2026-36601 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server CVSS 3.1MEDIUM 6.1
  • TI-2025-16999 Cosmos userbase checking vulnerability CVSS 4.0MEDIUM 6.9
  • TI-2026-36602 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences