NestJS auth service vulnerabilities

2 known vulnerabilities in NestJS auth service from EnergizeLab. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  NestJS auth service: Authorization Bypass Through User-Controlled Key

  CVE-2026-105040Oct 15, 2026EnergizeLab

  The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

• 8.2 High severity

  NestJS auth service: Improper Authentication

  CVE-2026-105034Oct 15, 2026EnergizeLab

  The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services