JTL-WMS MobileServer: Authentication bypass due to missing token check
Summary
The authorization middleware of the WMS MobileServer, a component of JTL-WMS, does not require authentication for requests with HTTP methods other than GET and HEAD, and for requests with malformed or non-bearer Authorization headers. A remote attacker with network access to the service can call API functions without valid credentials. According to the vendor, this flaw combined with CVE-2026-89310 (SQL injection) allows unauthenticated SQL execution on the database server, which can lead to full takeover of the database server.
Affected
- JTL-WMS 2.0 up to before 2.0.7
- JTL-WMS 2.1 up to before 2.1.3
- JTL-WMS 2.2 up to before 2.2.1
- Versions before 2.0 are not affected by CVE-2026-89309 according to the vendor.
- Only installations where the WMS MobileServer is set up and running are affected. The default port is TCP 8080 (configurable).
Fixed in
- 2.0.7
- 2.1.3
- 2.2.1
The CNA record gives 2.1.2 as the 2.1.x threshold; the vendor advisory states 2.1.3, which is used here.
Workaround
- No vendor workaround published.
- Restrict network access to the WMS MobileServer to known devices via LAN or VPN and do not expose it to the internet.
- Review logs for unexpected API requests.
Exploitation
- No known exploitation in the wild (CISA SSVC: exploitation none).
- EPSS score 0.00389.
- No public proof of concept found.
Our recommendation
- Check whether the WMS MobileServer is installed and running. If not, no action is needed.
- Update to 2.0.7, 2.1.3 or 2.2.1, matching your release branch.
- Remove any internet exposure of the MobileServer.
- Review logs for unexpected API activity and check the database account used by the application.
- Versions before 2.0 receive no patch for CVE-2026-89310 and must be upgraded to 2.0.7 or later.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JTL Security Advisory CVE-2026-89309 / CVE-2026-89310 www.jtl-software.com
- Vulners: CVE-2026-89309 (Rapid7 record) vulners.com
- OffSeq Radar: CVE-2026-89309 radar.offseq.com
- CVEBrief security brief, 14 Oct 2026 cvebrief.com
- Strix: CVE-2026-89310 (companion SQL injection) www.strix.ai
- JTL community forum: MobileServer authentication too weak (community, not vendor) forum.jtl-software.de
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:27.
Original description (NVD)
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.