CVE-2026-89309 Details
Description
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.
A vulnerability in the WMS MobileServer authorization middleware allows authentication to be bypassed in two scenarios. Firstly, the middleware only requires an Authorization header for GET and HEAD requests, while requests using other HTTP methods are processed without authentication. Secondly, for any HTTP method, a request with a malformed or non-bearer Authorization header is accepted without requiring a valid token. Although the middleware validates a token when a well-formed one is present, it fails to enforce this requirement in these two cases. As a result, a remote attacker with network access to the service can invoke API functionality without valid credentials.
Users can upgrade to JTL WMS MobileServer versions 2.0.7, 2.1.3, or 2.2.1 to address this vulnerability. After updating, no further action is required.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310 | ENISA | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | ENISA |
Affected Products
| Product | Versions |
|---|---|
| JTL-Software WMS MobileServer | >= 2.0, < 2.0.7 >= 2.1, < 2.1.3 >= 2.2, < 2.2.1 >= 1.7.0, <= 1.11.x |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | CVE Modified | ENISA |
| Oct 13, 2026 | New CVE Received | ENISA |