CVE-2026-71214 Details

An authorization bypass vulnerability has been identified in the Aerie/PlanDev sequencing server. The issue arises in the server's authorization middleware, specifically in the file 'sequencing-server/src/app.ts'. The vulnerability allows an unauthenticated attacker to manipulate session roles by sending a crafted request body. The middleware incorrectly prioritizes session variables from the client-supplied JSON over verified JWT claims from the Authorization header, without confirming the request's origin from Hasura. This flaw enables the attacker to inject arbitrary expansion rules into the 'sequencing.expansion_rule' database, which control the translation of spacecraft activities into commands. Additionally, the 'POST /put-dictionary' endpoint is openly accessible without authentication, permitting unauthorized modifications to command dictionaries.