Authentication Bypass in EnergizeLab Eilik NestJS Auth Service
CVE-2026-105034

8.2HIGH

Key Information:

Vendor

Energizelab

Status
Nestjs Auth Service
Vendor
CVE Published:
15 October 2026

What is CVE-2026-105034?

The EnergizeLab Eilik NestJS authentication service has a critical security flaw that allows unauthenticated attackers to issue valid device tokens for any robot serial number. This vulnerability enables malicious actors to impersonate legitimate devices, potentially compromising the integrity of cloud services. As a result, unauthorized access to robot functionalities can occur, leading to exploitation and unauthorized control over devices. Timely mitigation is essential to safeguard affected systems.

Affected Version(s)

NestJS auth service 1.8.2

References

https://github.com/xn0tsa/your-secrets-are-safe-with-me
technical-description
https://takeonme.org/gcves/GCVE-1337-2026-000000000000000...
third-party-advisory
https://www.theverge.com/tech/1010727/eiliko-robot-hack-e...
media-coverage

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sammy Azdoufal
todb of AHA!
.