nestjs_auth_service vulnerabilities
CVEs whose affected-version data names the nestjs_auth_service package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-105034High· 8.2EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device aga…
▾ TwilightEnergizeLab · NestJS auth servicevia CVEORG
CVE-2026-105040High· 8.8EnergizeLab Eilik User-ID Mass Assignment Account Takeover
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
▾ TwilightEnergizeLab · NestJS auth servicevia CVEORG