jt808-server web management API missing authentication

A web management server can be entered by anyone without a password.

Summary

The web management API of yezhihao jt808-server lacks authentication, so a remote attacker can reach it without logging in. Public exploit code exists, and the vendor did not respond to the disclosure.

What to do

No fixed version is named. The affected range runs up to commit a07f68c466b560b97ef41edb8a4966469abdf83e, so check that your build is newer than that and read the vendor's advisory. Do not leave the web management feature open to the internet.

Products and platforms

jt808-server

CVE IDs

CVE-2026-121926 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · gist.github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 17:00 UTC

First seen 2026-11-09 16:00 UTC