{"id":"PYSEC-2026-2242","details":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.","aliases":["CVE-2026-42084","GHSA-wgx6-g857-jjf7"],"modified":"2026-07-13T07:15:38.673576423Z","published":"2026-05-04T18:16:30.357Z","references":[{"type":"ADVISORY","url":"https://github.com/OpenC3/cosmos/releases/tag/v6.10.5"},{"type":"ADVISORY","url":"https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3"},{"type":"FIX","url":"https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776"},{"type":"EVIDENCE","url":"https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7"}],"affected":[{"package":{"name":"openc3","ecosystem":"PyPI","purl":"pkg:pypi/openc3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.5"}]}],"versions":["0.1.0","5.10.0","5.10.1","5.11.0","5.11.1","5.11.2","5.11.3","5.12.0","5.13.0","5.14.0","5.14.1","5.14.2","5.15.0","5.15.1","5.15.2","5.16.0","5.16.1","5.16.2","5.17.0","5.17.1","5.18.0","5.19.0","5.20.0","5.9.2b0","6.0.0","6.0.1","6.0.2","6.1.0","6.10.0","6.10.1","6.10.2","6.10.3","6.10.4","6.2.0","6.2.1","6.3.0","6.4.0","6.4.1","6.4.2","6.5.0","6.5.1","6.6.0","6.7.0","6.8.0","6.8.1","6.9.0","6.9.1","6.9.2"],"ecosystem_specific":{},"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/openc3/PYSEC-2026-2242.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}