id: PYSEC-2026-2242
published: "2026-05-04T18:16:30.357Z"
modified: "2026-07-13T05:50:29.540760Z"
aliases:
- CVE-2026-42084
- GHSA-wgx6-g857-jjf7
details: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.
affected:
- package:
    name: openc3
    ecosystem: PyPI
    purl: pkg:pypi/openc3
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 6.10.5
  versions:
  - 0.1.0
  - 5.10.0
  - 5.10.1
  - 5.11.0
  - 5.11.1
  - 5.11.2
  - 5.11.3
  - 5.12.0
  - 5.13.0
  - 5.14.0
  - 5.14.1
  - 5.14.2
  - 5.15.0
  - 5.15.1
  - 5.15.2
  - 5.16.0
  - 5.16.1
  - 5.16.2
  - 5.17.0
  - 5.17.1
  - 5.18.0
  - 5.19.0
  - 5.20.0
  - 5.9.2b0
  - 6.0.0
  - 6.0.1
  - 6.0.2
  - 6.1.0
  - 6.10.0
  - 6.10.1
  - 6.10.2
  - 6.10.3
  - 6.10.4
  - 6.2.0
  - 6.2.1
  - 6.3.0
  - 6.4.0
  - 6.4.1
  - 6.4.2
  - 6.5.0
  - 6.5.1
  - 6.6.0
  - 6.7.0
  - 6.8.0
  - 6.8.1
  - 6.9.0
  - 6.9.1
  - 6.9.2
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
- type: ADVISORY
  url: https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
- type: FIX
  url: https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776
- type: EVIDENCE
  url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N