CVE-2026-105040

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update…

Risk score: 58/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.3%
Published: 15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.8 high

References

https://github.com/xn0tsa/your-secrets-are-safe-with-me
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000011111111111111111111000000000000000000011111101001111111110000000000000000000011111111111111111111000000000000010100/
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Original description

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

Last activity 15 Oct 2026. Patch Forecast updates every hour.