# CVE-2026-114611: OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management.


- **Severity:** Critical 9.1 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`)
- **Exploited in the wild:** Not known
- **Fix available:** No
- **Published:** 22 Oct 2026
- **Updated:** 29 Oct 2026
- **Also known as:** GHSA-p549-5h7r-7639

## What is CVE-2026-114611?

CVE-2026-114611 is a critical vulnerability in schorschii OCO-Server, published on 22 Oct 2026. 

### Official description

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.

Weakness: CWE-295 (Improper Certificate Validation)

## Which versions are affected by CVE-2026-114611?


## How do I fix CVE-2026-114611?

No fix has been published for CVE-2026-114611 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-114611 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114611 exists.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-114611 and fix it if it is affected.

What it is: CVE-2026-114611 is a critical vulnerability in schorschii OCO-Server, published on 22 Oct 2026. 
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114611 exists.

Affected product: schorschii OCO-Server. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-114611/ (Markdown: https://insights.sbomify.com/CVE-2026-114611/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-114611
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-114611
- OSV: https://osv.dev/vulnerability/CVE-2026-114611

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-114611/
Summaries are generated and may contain mistakes; the official description above is the record.