CVE-2026-105040High· 8.8▾ TwilightThe EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
nestjs_auth_service 1.8.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105034High· 8.2EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
CVE-2026-105032Critical· 9.1EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write
CVE-2026-105038Critical· 9.8EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
CVE-2026-105035High· 7.8EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
CVE-2026-105033High· 8.8EnergizeLab AI Station Default Root Credentials with SSH Enabled
CVE-2026-105039Critical· 9.6EnergizeLab Station Middleware Admin APIs Missing Role Checks