nestjs_auth_service vulnerabilities
CVEs whose affected-version data names the nestjs_auth_service package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-105034High· 8.2The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device aga…
▾ TwilightEnergizeLab · NestJS auth serviceEPSS 0.56%via NVD
CVE-2026-105040High· 8.8The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment)
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
▾ TwilightEnergizeLab · NestJS auth serviceEPSS 0.35%via NVD