---
id: CVE-2026-89309
title: |-
  The authorization middleware of the WMS MobileServer
  fails to require authentication in two distinct cases
summary: |-
  The authorization middleware of the WMS MobileServer
  fails to require authentication in two distinct cases. First, it
  only requires an Authorization header for GET and HEAD requests; requests
  using any other HTTP method are processed wit…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: JTL SW GmbH
product: JTL-WMS
affected:
  - JTL-WMS < 2.0.7
  - JTL-WMS < 2.1.2
  - JTL-WMS < 2.2.1
  - 'JTL-WMS 1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.*'
published: '2026-10-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:04:29.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89309'
references:
  - url: 'https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310'
    label: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
  - url: 'https://www.enisa.europa.eu'
    label: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
tags:
  - nvd
  - cve.org
epss: 0.00389
epssPercentile: 0.32799
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T17:03:43.189746Z'
ingestedAt: '2026-10-13T09:20:23.197Z'
---

## Overview

The authorization middleware of the WMS MobileServer
fails to require authentication in two distinct cases. First, it
only requires an Authorization header for GET and HEAD requests; requests
using any other HTTP method are processed without an authentication check.
Second, for any HTTP method including GET and HEAD, a request carrying a
malformed or non-bearer Authorization header is passed through without
a valid token being required.





The middleware does validate a token whenever a
well-formed one is present, but in these two cases it does not
require one. A remote attacker with network access to the service can
therefore invoke API functionality without valid credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.