{"id":"CVE-2026-71214","published":"2026-08-05T08:16:43.807","lastModified":"2026-08-10T12:17:25.297","description":"The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/NASA-AMMOS/plandev","tags":[]}],"exploitRefs":[{"url":"https://github.com/NASA-AMMOS/plandev","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to bypass authentication by manipulating the session_variables object in the request body instead of using the Authorization header's JWT claims.","exploitability":"Exploitation requires control over the client-supplied JSON request body and no verification of Hasura origin, making it relatively easy for attackers with access to this vector.","blast_radius":"If exploited, this could lead to unauthorized access, data modification, or full system compromise, depending on the server's permissions and configurations.","remediation":"Implement strict validation and verification of JWT claims from the Authorization header before using any session-related variables in the request body.","tags":["auth-bypass","jwt","session","hasura"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:43:03.121Z"}}