OpsTree REMS Authentication Bypass Vulnerability

OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field.

Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.

• Affected versions: OpsTree REMS through 1.0.0
• Attack type: unauthenticated
• Impact: SuperUser administrative access