CVE-2026-48117: DroneAware Account Pre-Hijacking Vulnerability (Fixed)

Technical summary

The vulnerability stems from a pre-activation account registration vulnerability (CWE-287: Improper Authentication, CWE-302: Authentication Bypass by Assumed Immutable Data). The DroneAware centralized server failed to prevent account registration with an email address not yet claimed by an activated user. The attack flow: (1) attacker registers account using victim's email + attacker-controlled password; (2) victim receives activation email and clicks verification link or authenticates via Google SSO; (3) both the attacker's password and the victim's activation remain valid simultaneously; (4) attacker gains persistent access. The root cause appears to be insufficient uniqueness constraints or race-condition handling during the account activation workflow. The fix was deployed server-side on 2026-05-20 and requires no client-side changes. Node binaries and self-hosted detection nodes are unaffected.

Business impact

For DroneAware users, account compromise could expose sensitive drone detection data, surveillance configurations, system logs, and potentially geographical or operational intelligence tied to the platform. An attacker with persistent account access could monitor detection activity, modify alert rules, or exfiltrate threat information. However, the server-side fix deployed in May 2025 has already eliminated this attack vector, so active exposure is minimal for current users. Organizations that operate self-hosted DroneAware nodes or rely solely on Node binaries are not impacted.

Affected systems

The vulnerability affects user accounts on the centralized DroneAware server backing droneaware.io. Self-hosted detection nodes and Node binaries are explicitly unaffected. Any user account created on the main platform between the vulnerability's introduction and the May 20, 2025 fix was potentially exposed to pre-hijacking during the registration and activation window.

Exploitability

Exploitation required moderate effort and social knowledge: the attacker must identify or target a specific victim's email address and successfully register an account before that victim completed activation. The CVSS 3.1 score of 6.8 (MEDIUM) reflects this constraint—while the impact (confidentiality and integrity compromise) is high, the attack complexity is high (AC:H) and user interaction is required (UI:R). Real-world exploitation would have been opportunistic or targeted rather than mass-scale. The vulnerability is now patched; no active exploitation risk remains.

Remediation

No user action is required. The vulnerability was fixed server-side on May 20, 2025, and the fix is already deployed across the droneaware.io platform. All existing accounts are now protected against this attack vector. Users do not need to change passwords, re-authenticate, or modify any settings. Self-hosted deployments and Node binaries require no updates.

Patch guidance

The vulnerability has already been remediated via server-side deployment on May 20, 2025. Users of droneaware.io are automatically protected and need not take any action. Organizations operating self-hosted instances should verify they are running the latest server version from the DroneAware vendor—consult the official vendor advisory for specific version information if self-hosting. Node binary users are unaffected and do not require updates.

Detection guidance

To identify if an account was compromised during the vulnerable window (pre-May 20, 2025), review account login history within the DroneAware platform for unusual access patterns, IP addresses, or timestamps that do not match your organization's known usage. Check for unauthorized modifications to detection rules, alert thresholds, or system configurations. If you suspect a compromise, change your password immediately and review any exported data or system logs for exfiltration. Monitor the DroneAware platform's audit logs (if available) for account activity during the window when the account was activated but before you first logged in.

Why prioritize this

Although the CVSS score is MEDIUM (6.8), this vulnerability should be monitored historically rather than actively remediated, as the fix is already deployed. Organizations that used DroneAware during the vulnerable window should verify account integrity and review access logs for signs of compromise. The vulnerability is notable because it bypasses standard authentication mechanisms (including Google SSO), making it a high-integrity threat despite moderate exploitability. New or prospective DroneAware users can adopt the platform with confidence.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects a high-impact but moderately-exploitable vulnerability. Confidentiality and integrity are fully compromised upon successful exploitation (C:H, I:H), but availability is not affected (A:N). Attack complexity is high (AC:H) due to the race condition and timing constraints required. User interaction is required (UI:R) because the victim must complete the activation workflow. Network attack surface (AV:N) is present because the attack targets the web-facing registration endpoint. The score appropriately captures the threat: serious for targeted accounts but not trivially exploitable at scale.

Frequently asked questions