CVE-2026-26342

Description

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5976.php

https://www.vulncheck.com/advisories/tattile-smart-vega-basic-insufficient-session-token-expiration

https://www.tattile.com/

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4