Authentication Bypass Vulnerability in OpenAEV by OpenAEV Platform

CVE-2026-71854

What is CVE-2026-71854?

OpenAEV is an open-source platform for conducting cyber adversary simulations. A vulnerability in versions prior to 2.260622.0 allows for unauthenticated access to lessons endpoints, enabling malicious actors with knowledge of an exercise UUID to read sensitive lessons-learned questions and answers, including the identities of authors. Additionally, an attacker can modify or overwrite answers for any user. This flaw arises from the lack of verification for the userId query parameter, leading to significant risks for user data integrity.

References