CVE-2026-42084 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

What is CVE-2026-42084?

CVE-2026-42084 is a high-severity authentication bypass vulnerability in OpenC3 cosmos, published on 4 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.

Weakness: CWE-620

Which versions are affected by CVE-2026-42084?

5 open source packages ship an affected version, including openc3. It affects 1 product.

Products include Openc3 Cosmos.

How do I fix CVE-2026-42084?

Upgrade openc3 to a fixed version for your release line: 6.10.5 or 7.0.0-rc3.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-42084 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42084 exists.

Other vulnerabilities in OpenC3 cosmos

• CVE-2025-28386 Code injection in n/a Critical 9.8
• CVE-2025-28388 Hardcoded credentials in n/a Critical 9.8
• CVE-2025-28389 Weak cryptography in n/a Critical 9.8
• CVE-2026-42087 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base Critical 9.6
• CVE-2026-42088 OpenC3 COSMOS: Administrative Actions via the Script Runner Tool Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wgx6-g857-jjf7, PYSEC-2026-2242.