Authentication Bypass in Ground Station by SGoudelis
CVE-2026-103244

9.3CRITICAL

Key Information:

Vendor

Sgoudelis

Status
Ground-station
Vendor
CVE Published:
1 October 2026

What is CVE-2026-103244?

Versions of Ground Station prior to 0.8.0 are vulnerable to an authentication bypass through the setup.restore command. This flaw allows unauthenticated attackers to leverage Socket.IO to execute arbitrary SQL during the initial setup process. By exploiting this vulnerability, attackers can create admin users and generate forged session tokens, effectively allowing them to authenticate as administrators without valid credentials. This loophole poses a significant risk, enabling complete control over the application.

Affected Version(s)

ground-station 0 < 0.8.0

References

https://github.com/sgoudelis/ground-station/security/advi...
vendor-advisory
https://github.com/sgoudelis/ground-station/commit/940df2...
patch
https://www.vulncheck.com/advisories/ground-station-befor...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0x4r35
.