CVE-2026-102298
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required…
- Risk score
- 52/100
- CVSS
- 7.5 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
References
Original description
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.
Last activity 14 Oct 2026. Patch Forecast updates every hour.