{"id":"CVE-2026-71214","summary":"NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server","details":"The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.","modified":"2026-10-21T02:59:10.224314408Z","published":"2026-08-05T06:59:32.771Z","database_specific":{"cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71214.json","cna_assigner":"TuranSec"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71214.json"},{"type":"ADVISORY","url":"https://github.com/NASA-AMMOS/plandev"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71214"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nasa-ammos/plandev","events":[{"introduced":"0"},{"last_affected":"0"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0"},{"last_affected":"0"}]}]}}],"versions":["0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71214.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}